Right Way Theme CVE-2026-22330

The target WordPress site must have the Themeum Right Way theme installed and active at version ≤ 4.0, with the vulnerable PHP file include endpoint reachable over the network (default for any public WordPress front end). No WordPress account or user interaction is required (PR:N/UI:N). Limiting factors per CVSS AC:H: exploitation depends on conditions outside the attacker's control - likely a specific request shape, parameter name, or PHP stream wrapper / configuration (e.g. allow_url_include, open_basedir) - meaning hardened PHP installations or sites where the vulnerable include path is not triggered in the request flow may not be exploitable. Patchstack's description does not enumerate the exact parameter, so the precise trigger conditions are not independently confirmed from the available data.

Signals are mixed. CVSS 3.1 of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects an unauthenticated network-reachable flaw with full CIA impact, but AC:H indicates non-trivial conditions (likely a specific parameter, request shape, or wrapper requirement) that reduce mass-exploitation potential. No EPSS, KEV, or SSVC data was provided in the input, and no public POC was referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' The Patchstack tagging as LFI plus CWE-98 (which is typically RCE-class) suggests the realistic worst case is code execution, not just file disclosure, so any internet-exposed WordPress site running this theme should treat it as a high priority despite the absence of active-exploitation evidence. Missing data to flag: no fix version, no EPSS, no KEV entry, no independent advisory beyond Patchstack.

An attacker scans WordPress sites for the Right Way theme by fingerprinting /wp-content/themes/rightway/ assets, then sends a crafted unauthenticated HTTP request whose parameter coerces a theme PHP script to include an attacker-controlled or sensitive local file (for example reading wp-config.php to steal database credentials, or chaining a PHP filter/log-poisoning wrapper to execute arbitrary PHP). No public POC has been identified at time of analysis, and the CVSS AC:H rating suggests the attacker must satisfy a specific parameter or wrapper condition for the include to succeed.