PHP CVE-2026-22494

Requires ThemeREX Good Homes WordPress theme version <= 1.3.13 with specific PHP include/require vulnerable code path. Remote unauthenticated attacker can exploit via crafted request with local file inclusion payload. AC:H indicates non-trivial exploitation technique needed (likely file path manipulation or race condition).

While no CVSS score, CVSS vector, or EPSS probability was provided, the vulnerability presents significant real-world risk based on available intelligence signals. LFI vulnerabilities are highly exploitable (typically CVSS attack vector: Network, low complexity) and require minimal attacker privileges. The tags confirm Information Disclosure impact, meaning attackers can read sensitive files (database credentials, API keys, configuration data) or achieve Remote Code Execution (RCE) if they can write files or chain the LFI with other weaknesses. The absence of KEV designation does not diminish risk; many theme vulnerabilities go unreported in official databases but are actively exploited in the wild. Given that WordPress themes are widely deployed and unauthenticated LFI is easily exploitable, this should be treated as a high-priority vulnerability despite missing formal CVSS/EPSS scores. The lack of published POC data from the reference sources does not indicate low exploitability—LFI techniques are well-documented and easily weaponized.

An attacker crafts a malicious HTTP request to a WordPress site running Good Homes ≤1.3.13, injecting a file path parameter (e.g., ?file=../../../../etc/passwd or ?template=php://filter/convert.base64-encode/resource=wp-config.php) into a vulnerable theme function that passes user input unsanitized to a PHP include() statement. The server then includes the attacker-specified file, either disclosing its contents directly to the attacker or allowing execution of malicious code. This attack requires only network access and no authentication, making it trivially exploitable for any attacker with basic LFI knowledge; no POC is needed, as the technique is decades-old and well-documented.