What is the CVSS score of CVE-2026-22330?

CVE-2026-22330 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Right Way Theme are affected by CVE-2026-22330?

The Themeum Right Way WordPress theme (versions 4.0 and earlier) contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that enables attackers to read arbitrary server files and…

How to fix or mitigate CVE-2026-22330?

Within 24 hours: Audit all WordPress installations for Themeum Right Way theme v4.0 and earlier; disable or deactivate the theme immediately. Within 7 days: Deploy Web Application Firewall rules blocking path traversal patterns and file inclusion attempts; implement access logging to detect exploitation attempts. Within 30 days: Migrate WordPress sites to actively maintained themes; establish theme inventory and update policy requiring quarterly version verification.

Right Way Theme CVE-2026-22330

EUVD-2026-37653 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Right Way

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress endpoint with no auth or interaction (AV:N/PR:N/UI:N); AC:H reflects specific parameter/wrapper conditions; CWE-98 LFI typically yields full CIA impact via code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:33 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Themeum Right Way WordPress theme versions 4.0 and earlier allows remote attackers to include arbitrary local files and likely achieve code execution through PHP file inclusion (CWE-98). The flaw is network-reachable without credentials, though CVSS records high attack complexity (AC:H), and no public exploit has been identified at time of analysis. The advisory is sourced from Patchstack's WordPress vulnerability database.

Technical ContextAI

Right Way is a commercial WordPress theme distributed by Themeum (CPE cpe:2.3:a:themeum:right_way). The root cause is CWE-98 - Improper Control of Filename for Include/Require Statement in PHP, in which user-controlled input is passed into PHP include/require constructs without proper validation or allow-listing. In a WordPress theme this typically manifests as a parameter (e.g. page, file, template) consumed by a theme PHP file that resolves filesystem paths, enabling traversal to sensitive files such as wp-config.php or, depending on PHP configuration and wrappers (php://filter, data://, phar://), local-to-remote code execution. Because the theme code runs in the WordPress request lifecycle, exploitation does not require WordPress authentication.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack record covers versions ≤ 4.0 without naming a fixed release, so administrators should monitor https://patchstack.com/database/wordpress/theme/rightway/vulnerability/wordpress-right-way-theme-4-0-local-file-inclusion-vulnerability and the Themeum vendor channel for an updated version above 4.0 and upgrade as soon as one is published. In the interim, deactivate and remove the Right Way theme if it is not in active use, or switch the site to a different theme - this is the only fully effective mitigation. Compensating controls while the theme remains live: deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) that blocks requests containing path-traversal sequences (../, %2e%2e, php://, data://, phar://) targeting theme endpoints under /wp-content/themes/rightway/, accepting that legitimate template parameters may be blocked; restrict PHP open_basedir and disable allow_url_include in php.ini to limit traversal scope, at the cost of breaking plugins that legitimately use stream wrappers; and place the WordPress instance behind authenticated access (HTTP basic auth or IP allow-listing on the front end) until a fix ships.