CVE-2026-22435
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ElectroServ electroserv allows PHP Local File Inclusion.This issue affects ElectroServ: from n/a through <= 1.3.2.
Analysis
ElectroServ through version 1.3.2 contains a local file inclusion vulnerability in its PHP-based file handling that enables unauthenticated attackers to read arbitrary files from the server. An attacker can exploit this weakness over the network without user interaction to access sensitive data or potentially execute code through log poisoning techniques. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all instances of ElectroServ theme in use and document affected properties; temporarily disable the theme on non-critical sites if possible. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns and conduct urgent security review of exposed data; contact vendor for hotfix timeline. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today