PHP CVE-2026-22324

ThemeREX Melania versions up to 2.5.0. Remote unauthenticated attacker exploiting PHP Local File Inclusion via improper filename control in include/require statements. Requires specific URL parameter manipulation; high attack complexity suggests non-default configuration or specific parameter conditions needed.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable vulnerability requiring no privileges or user interaction, with high impact across confidentiality, integrity, and availability. However, the high attack complexity (AC:H) suggests exploitation requires specific conditions or timing. Without EPSS data provided, KEV inclusion, or known public exploits, the immediate risk is moderate despite the high CVSS score. The vulnerability is automatable once conditions are met, and technical impact is high (potential for full server compromise through chained exploitation with log poisoning or other techniques). Real-world risk prioritization should consider whether the Melania theme is internet-facing and whether the specific exploitation conditions can be met in the environment. For organizations using this theme, this should be treated as a priority patch given the potential for complete system compromise, but it is not an emergency requiring immediate after-hours response in the absence of active exploitation indicators.

An unauthenticated attacker identifies a vulnerable Melania theme installation and crafts specially formatted HTTP requests containing directory traversal sequences to a vulnerable endpoint that improperly handles file path parameters. By manipulating the file path parameter, the attacker includes sensitive files like wp-config.php to extract database credentials, or includes server log files after first poisoning them with PHP code through User-Agent headers or other logged input fields. Once code execution is achieved through log poisoning or another chain technique, the attacker gains full control of the WordPress installation and potentially the underlying server, enabling data theft, website defacement, or use of the server in further attacks.