Promo WordPress Theme CVE-2026-22325

Exploitation requires the target WordPress site to have the AxiomThemes Promo theme installed and active at version 1.3.0 or earlier, with the vulnerable include path reachable over HTTP(S). The CVSS vector AV:N/AC:H/PR:N/UI:N indicates no authentication and no user interaction are needed, but AC:H signals that the attacker must satisfy a non-trivial precondition - typically the exact parameter name, a specific theme page or shortcode rendering the vulnerable code path, and a server filesystem layout that permits traversal to a useful target file (e.g., wp-config.php or an uploaded payload). Successful escalation to code execution further depends on the attacker being able to plant or locate an includable PHP file (such as via an unrelated upload feature) or on PHP being configured to interpret a readable file.

Signals are mixed. The CVSS vector AV:N/AC:H/PR:N/UI:N indicates remote, unauthenticated exploitation with no user interaction but elevated attack complexity, suggesting some non-trivial condition (e.g., a specific parameter, request shape, or environment) must be met. Confidentiality, integrity, and availability are all rated High, consistent with LFI escalating to code execution or sensitive disclosure. No EPSS score, KEV listing, or public POC was provided in the input, so widespread automated exploitation is not currently evidenced; however, WordPress theme LFIs historically attract opportunistic scanning once a Patchstack advisory is indexed. EPSS and KEV data are missing from the input and should be re-checked before final prioritization. Net: a real priority for any site running Promo <= 1.3.0, but the AC:H qualifier and absence of confirmed in-the-wild activity place it below known-exploited WordPress flaws.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Promo theme endpoint with a path-traversal payload in the susceptible parameter, causing the theme's PHP code to include a local file such as wp-config.php (disclosing database credentials and auth keys) or an uploaded PHP file (yielding remote code execution under the web server user). No public POC has been identified at the time of analysis, but the Patchstack advisory provides enough context for skilled actors to derive one, and the AC:H rating suggests the working exploit requires correct parameter naming or specific request conditions rather than a one-shot URL.