What is the CVSS score of CVE-2026-22496?

CVE-2026-22496 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22496?

CVE-2026-22496 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22496?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22496

EUVD-2026-15502 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15502

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hypnotherapy hypnotherapy allows PHP Local File Inclusion.This issue affects Hypnotherapy: from n/a through <= 1.2.10.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the AncoraThemes Hypnotherapy WordPress theme through version 1.2.10, allowing attackers to read arbitrary files from the affected server by manipulating filename parameters in PHP include/require statements. This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement) and enables information disclosure attacks. The vulnerability has been documented by Patchstack and assigned EUVD ID EUVD-2026-15502, though no CVSS score or CVSS vector has been formally assigned, and active exploitation status remains unconfirmed in public intelligence.

Technical ContextAI

The vulnerability resides in the AncoraThemes Hypnotherapy WordPress theme (CPE: cpe:2.3:a:ancorathemes:hypnotherapy:*:*:*:*:*:*:*:*) and stems from CWE-98, which describes improper control of filenames passed to PHP include() or require() statements. When user-supplied input is directly used to construct file paths without proper validation or sanitization, attackers can traverse the filesystem using relative or absolute path traversal sequences (e.g., '../../../etc/passwd'). In WordPress theme context, this typically occurs in template loading functions or file serving endpoints that do not adequately filter the file parameter. The affected technology chain involves PHP file inclusion mechanisms combined with inadequate input validation in the theme's core functionality.

RemediationAI

Immediately upgrade the AncoraThemes Hypnotherapy theme to a version later than 1.2.10; consult the Patchstack database entry (https://patchstack.com/database/Wordpress/Theme/hypnotherapy/vulnerability/wordpress-hypnotherapy-theme-1-2-10-local-file-inclusion-vulnerability?_s_id=cve) for patched version availability and installation instructions. If an immediate patch is unavailable, implement temporary mitigations by restricting direct web access to the affected theme files via .htaccess or web server configuration (deny access to any endpoints known to accept file parameters), enforce Web Application Firewall (WAF) rules to block path traversal sequences ('../', '..\', encoded variants), and consider disabling the Hypnotherapy theme temporarily in favor of a patched alternative. Monitor server logs and website behavior for signs of attempted or successful file reads from sensitive locations (/etc/passwd, wp-config.php, etc.), and audit for any unauthorized file access that may have occurred prior to patching.