What is the CVSS score of CVE-2026-22494?

CVE-2026-22494 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22494?

CVE-2026-22494 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22494?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22494

EUVD-2026-15497 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-9fr6-cc7f-8rfm

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15497

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Good Homes good-homes allows PHP Local File Inclusion.This issue affects Good Homes: from n/a through <= 1.3.13.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic server-side template injection and file inclusion flaw. The Good Homes theme, identified via CPE cpe:2.3:a:themerex:good_homes:*:*:*:*:*:*:*:*, implements PHP include() or require() statements that fail to properly sanitize or validate user-supplied input before constructing file paths. This allows attackers to manipulate filename parameters to traverse the filesystem and load arbitrary files such as /etc/passwd, configuration files, or uploaded malicious PHP scripts. The vulnerability affects all versions up to and including 1.3.13, suggesting the flaw has persisted across multiple theme releases without sufficient input validation controls.

RemediationAI

Immediately upgrade the ThemeREX Good Homes theme to a patched version newer than 1.3.13; contact ThemeREX or check their official release notes for the specific fixed version. Until an update is available, disable or remove the Good Homes theme and switch to an alternative theme. For defense-in-depth, configure your WordPress environment to restrict PHP file access via .htaccess rules (deny access to sensitive directories), implement file integrity monitoring to detect unexpected file inclusions, and use a Web Application Firewall (WAF) configured to block common LFI payloads (e.g., patterns containing ../, file://, etc.). Ensure WordPress core, all plugins, and themes are kept current, and regularly audit theme code for insecure include/require patterns. Review the Patchstack database entry for additional remediation guidance and patch availability status.