What is the CVSS score of CVE-2026-22331?

CVE-2026-22331 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of AutoParts WordPress Theme are affected by CVE-2026-22331?

ThemeREX AutoParts WordPress theme (versions 1.5.8 and earlier) contains an unauthenticated Local File Inclusion vulnerability enabling attackers to extract sensitive data and achieve remote code…

How to fix or mitigate CVE-2026-22331?

24 hours: Conduct inventory of all WordPress installations and identify systems running ThemeREX AutoParts theme. 7 days: Uninstall or disable the affected theme on all installations; if critical for operations, contact vendor for patch timeline or migrate to alternative theme. 30 days: Deploy Web Application Firewall (WAF) rules blocking file traversal attempts; audit server logs for unauthorized file access; verify no exposure of wp-config.php or database credentials.

AutoParts WordPress Theme CVE-2026-22331

EUVD-2026-37654 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Autoparts

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, no auth or user interaction; AC:H reflects the non-trivial parameter/wrapper precondition; LFI to wp-config.php enables full CIA impact via DB takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:33 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX AutoParts WordPress theme versions 1.5.8 and earlier allows remote attackers to include and execute arbitrary local files on the server. No public exploit identified at time of analysis, but the CWE-98 classification and PR:N CVSS vector make this a meaningful pre-authentication risk for any WordPress site running the theme. Successful exploitation typically leads to sensitive file disclosure (wp-config.php) and, when combined with log poisoning or uploaded content, full remote code execution.

Technical ContextAI

AutoParts is a commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:autoparts) and aimed at automotive parts retailers. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), the canonical PHP file-inclusion weakness in which user-controlled input reaches a require/include/include_once/require_once call without proper sanitization or allow-listing. In WordPress themes this pattern most often appears in AJAX handlers, shortcode renderers, or template-loader endpoints registered via admin-ajax.php or rewrite rules that accept a template/file parameter.

RemediationAI

No vendor-released patch identified at time of analysis; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/autoparts/vulnerability/wordpress-autoparts-theme-1-5-8-local-file-inclusion-vulnerability) and the ThemeREX/Envato product page for a release above 1.5.8 and upgrade as soon as one is available. As compensating controls, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity OWASP CRL rules 930100/930120) to block path-traversal sequences and php:// wrappers on requests to the theme's PHP endpoints, restrict open_basedir and allow_url_include=Off in php.ini to constrain what files PHP can include, and deny direct web access to wp-config.php and theme include directories at the web-server layer - note that aggressive path-traversal WAF rules can break legitimate query strings containing %2F or dot sequences, so test in detection mode first. If patching is not imminent, consider deactivating the AutoParts theme and switching to a default theme until a fix is shipped.