PHP CVE-2026-22496

AncoraThemes Hypnotherapy plugin <= 1.2.10. Remote unauthenticated attacker can exploit via crafted requests leveraging improper filename control in PHP include/require statements. AC:H suggests non-default configuration or specific parameter manipulation required.

While a formal CVSS score is not assigned, the vulnerability profile suggests moderate-to-high real-world risk based on available signals. The attack vector is network-accessible (typical for web-based LFI), requires minimal privileges (unauthenticated exploitation is possible depending on which endpoints are exposed), and has low attack complexity (standard path traversal techniques apply). No EPSS score, KEV status, or public proof-of-concept has been reported in the available intelligence, suggesting limited active exploitation to date. However, LFI vulnerabilities are generally considered highly automatable and often lead to full system compromise when chained with other attacks (e.g., log poisoning, session theft, or source code disclosure). Given that the vulnerability affects a WordPress theme with widespread potential deployment, the long tail risk is substantial; defenders should prioritize patching even without confirmed active exploitation, as LFI is a well-understood attack class with minimal barrier to exploitation.

An unauthenticated attacker identifies that the Hypnotherapy theme includes a file-serving endpoint (e.g., a template loader or media handler) that accepts a 'file' or 'template' parameter without validation. The attacker crafts a request such as 'http://target.com/wp-content/themes/hypnotherapy/loader.php?file=../../../../wp-config.php' to read the WordPress configuration file containing database credentials and authentication keys. Alternatively, the attacker could target '/etc/passwd' or other system files to enumerate server configuration. Given the low attack complexity and network accessibility of WordPress installations, exploitation requires minimal technical skill and no authentication, making this a high-priority vulnerability for any site running the affected theme version.