What is the CVSS score of CVE-2026-22338?

CVE-2026-22338 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of EcoBlue Theme are affected by CVE-2026-22338?

ThemeREX EcoBlue WordPress theme versions 1.15 and earlier contain an unauthenticated local file inclusion vulnerability (CVSS 8.1) allowing remote attackers to extract sensitive application code and…

How to fix or mitigate CVE-2026-22338?

Within 24 hours: Inventory all WordPress deployments and identify any instances using ThemeREX EcoBlue theme version 1.15 or earlier. Within 7 days: Either deactivate and replace the EcoBlue theme with an alternative, or deploy Web Application Firewall rules blocking local file inclusion patterns (../traversal, null bytes, php:// wrappers) against affected theme endpoints. Within 30 days: Monitor ThemeREX vendor advisory channels for patch release details; prepare and test deployment of the vendor patch across all affected systems upon availability.

EcoBlue Theme CVE-2026-22338

EUVD-2026-37658 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Ecoblue

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable theme endpoint, no auth or UI; AC:H reflects non-obvious precondition; full file read (C:H) but integrity/availability impact only via secondary RCE chain (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:31 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

AnalysisAI

Unauthenticated Local File Inclusion in ThemeREX EcoBlue WordPress theme versions 1.15 and earlier enables remote attackers to include arbitrary local files on the server without credentials, potentially leading to source code disclosure and remote code execution via PHP file inclusion (CWE-98). No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with WordPress's broad deployment surface makes this notable. EPSS data was not provided, and the issue is not listed in CISA KEV.

Technical ContextAI

EcoBlue is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:ecoblue). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where a user-controlled value flows into a PHP include/require call without proper sanitization or allowlisting. In WordPress themes this pattern typically appears in template loaders, AJAX handlers, or shortcode rendering endpoints that accept a 'file', 'template', or 'page' parameter and pass it to include() - allowing traversal sequences (../) or absolute paths to load arbitrary .php files from the filesystem. Depending on PHP configuration (allow_url_include, wrappers like php://filter) the flaw can range from source disclosure to RCE via log poisoning or session file inclusion.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data - administrators should consult the ThemeREX EcoBlue changelog and upgrade to the latest available release beyond 1.15 (verify the fixed version at https://patchstack.com/database/wordpress/theme/ecoblue/vulnerability/wordpress-ecoblue-theme-1-15-local-file-inclusion-vulnerability before deploying). As compensating controls until the patched theme is installed: deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) blocking requests to theme endpoints containing path-traversal sequences such as '../', 'php://', 'file://', or absolute paths in query parameters - side effect is potential false positives on legitimate template parameters. Set PHP open_basedir to restrict include scope to the WordPress directory tree (side effect: may break plugins relying on /tmp or shared libraries), disable allow_url_include in php.ini to prevent remote file inclusion escalation, and restrict filesystem read permissions on sensitive files (wp-config.php, /etc/passwd) where feasible. If the theme is not actively required, switch to a maintained theme as the durable fix.