How to fix CVE-2026-22478?

Within 24 hours: Identify all systems running FindAll plugin ≤1.4 and assess exposure (internet-facing vs. internal). Within 7 days: Implement WAF rules to block malicious file inclusion patterns and consider disabling the FindAll feature if non-critical. Within 30 days: Evaluate alternative plugins, upgrade to a patched version when available, or remove the plugin entirely if replacement options exist.

Is PHP affected by CVE-2026-22478?

A high-severity local file inclusion vulnerability in Elated-Themes FindAll plugin (versions ≤1.4) could allow attackers to read sensitive files from affected servers, potentially exposing credentials, configuration data, and intellectual property.

CVE-2026-22478

HIGH

2026-03-05 [email protected]

8.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes FindAll findall allows PHP Local File Inclusion.This issue affects FindAll: from n/a through <= 1.4.

Analysis

The FindAll plugin for PHP through version 1.4 contains a local file inclusion vulnerability that enables attackers to read arbitrary files from the affected system through improper input validation on file inclusion statements. An unauthenticated remote attacker can exploit this vulnerability to access sensitive files and potentially execute arbitrary code with the privileges of the web server process. …

Remediation

Within 24 hours: Identify all systems running FindAll plugin ≤1.4 and assess exposure (internet-facing vs. internal). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +40

POC: 0

CVE-2026-22478 vulnerability details – vuln.today

Back

CVE-2026-22478

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-22478

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code