What is the CVSS score of CVE-2026-22325?

CVE-2026-22325 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Promo WordPress Theme are affected by CVE-2026-22325?

The Promo WordPress theme by axiomthemes (versions ≤1.3.0) contains an unauthenticated local file inclusion vulnerability (CVE-2026-22325, CVSS 8.1) enabling attackers to read sensitive files or…

How to fix or mitigate CVE-2026-22325?

24 hours: Inventory all WordPress installations using Promo theme version ≤1.3.0. 7 days: Deploy Web Application Firewall rules to block local file inclusion patterns or deactivate the theme on all affected systems. 30 days: Migrate to alternative WordPress theme or apply vendor patch if released.

Promo WordPress Theme CVE-2026-22325

EUVD-2026-37648 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Promo Wordpress Theme Axiomthemes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated LFI with no user interaction; AC:H reflects required parameter/path conditions; CIA all High because included PHP can leak secrets and reach code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:36 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity.

Technical ContextAI

The affected component is the Promo commercial WordPress theme published by AxiomThemes (CPE cpe:2.3:a:axiomthemes:promo). The root cause maps to CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. In PHP, this class of bug occurs when user-supplied input (typically a GET/POST parameter) flows into include, require, include_once, or require_once without proper allowlisting or path normalization, allowing traversal sequences or absolute paths to load attacker-chosen files. Because the theme is loaded by WordPress, the included PHP runs in the context of the web server user and inherits WordPress's loaded environment, magnifying the impact of any included file.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack entry documents the issue against versions up to 1.3.0 but does not surface a fixed release in the provided data, so site operators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/promo/vulnerability/wordpress-promo-theme-1-3-0-local-file-inclusion-vulnerability) and the AxiomThemes vendor portal for an updated version. In the absence of a confirmed patched version, compensating controls include deploying a WAF rule (Patchstack vPatch, Wordfence, or ModSecurity OWASP CRS rule 930100/930110) to block path traversal sequences and absolute paths in theme-related parameters, hardening PHP via open_basedir restrictions to confine include() to the WordPress docroot (side effect: may break plugins that legitimately read outside the docroot), disabling allow_url_include and allow_url_fopen to prevent escalation to RFI (side effect: breaks plugins that fetch remote resources), and temporarily switching to an alternative theme if business needs allow until a fixed release is verified.