PHP CVE-2026-22495

AncoraThemes Greenville WordPress theme versions <= 1.3.2. Remote unauthenticated attacker can exploit PHP Local File Inclusion vulnerability via improper filename control in include/require statements. No victim interaction required. Requires theme to be installed and activated on vulnerable WordPress site.

Although no CVSS score, CVSS vector, or EPSS value has been published for this CVE, the technical nature of LFI vulnerabilities in WordPress themes represents a significant real-world risk. LFI vulnerabilities are consistently ranked as high-impact because they directly enable information disclosure and can serve as a stepping stone to Remote Code Execution (RCE) when combined with log poisoning or null-byte injection techniques. The affected product is a widely-distributed WordPress theme (Greenville), meaning exposure is potentially broad across websites using versions up to 1.3.2. The absence of published CVSS/EPSS metrics does not diminish the technical severity; rather, it reflects that formal scoring may still be pending. Given the lack of KEV status data and limited public POC information at this time, the immediate exploitation risk is moderate but should not be underestimated given the ease of exploiting LFI vulnerabilities and the commonality of WordPress theme deployments.

An attacker crafts a malicious URL targeting the vulnerable Greenville theme parameter, such as by appending a file path traversal payload (e.g., ?file=../../../../etc/passwd or ?include=../wp-config.php) to a theme function or template endpoint. The PHP include/require statement processes the unsanitized input without validation and loads the attacker-specified local file, returning its contents in the HTTP response or error messages. The attacker thus gains read access to sensitive files such as wp-config.php (containing database credentials), wp-settings.php, .env files, or system files, enabling credential theft, further reconnaissance, or privilege escalation attacks. The attack vector is network-based and requires no authentication or special privileges, making exploitation straightforward for an attacker with basic knowledge of LFI techniques.