What is the CVSS score of CVE-2026-22498?

CVE-2026-22498 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22498?

CVE-2026-22498 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22498?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22498

EUVD-2026-15503 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-wv7w-xxww-66w7

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15503

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through <= 3.1.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Laurent WordPress theme (versions up to 3.1) due to improper control of filenames in PHP include/require statements, allowing attackers to read arbitrary files from the affected server. This vulnerability, reported by Patchstack and tracked as EUVD-2026-15503, enables information disclosure attacks without requiring authentication or special privileges. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP) and affects all installations of Laurent theme version 3.1 and earlier.

Technical ContextAI

The vulnerability stems from inadequate input validation on user-supplied parameters that are passed directly to PHP include() or require() statements. CWE-98 describes this class of weakness where an application constructs a file path using external input without proper sanitization, enabling attackers to traverse the filesystem or include remote files. The Laurent theme (CPE: cpe:2.3:a:elated-themes:laurent:*:*:*:*:*:*:*:*) is a WordPress theme distributed through the WordPress theme ecosystem. The LFI vulnerability allows an attacker to manipulate path parameters to read sensitive files such as configuration files (wp-config.php), system files (/etc/passwd), or other sensitive data stored on the server, potentially leading to credential theft, configuration disclosure, and further compromise.

RemediationAI

Website administrators using the Laurent theme must immediately upgrade to a patched version greater than 3.1 if available from the Elated-Themes vendor, or disable the theme and switch to an alternative until a patch is released. The vendor advisory should be consulted at https://patchstack.com/database/Wordpress/Theme/laurent/vulnerability/wordpress-laurent-theme-3-1-local-file-inclusion-vulnerability-2?_s_id=cve for patch availability and timeline. As an interim mitigation, implement Web Application Firewall (WAF) rules to detect and block common LFI payload patterns (e.g., requests containing '../', 'php://', 'file://' in parameter values), restrict file permissions on sensitive files to limit exposure if traversal occurs, and monitor server logs for suspicious file inclusion attempts. Additionally, ensure WordPress core and all plugins are fully patched, and consider implementing a security plugin that monitors theme integrity.