What is the CVSS score of CVE-2026-22499?

CVE-2026-22499 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22499?

CVE-2026-22499 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22499?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22499

EUVD-2026-15506 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15506

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Lella lella allows PHP Local File Inclusion.This issue affects Lella: from n/a through <= 1.2.

AnalysisAI

This vulnerability is a Local File Inclusion (LFI) flaw in the Elated-Themes Lella WordPress theme that allows improper control of filename parameters in PHP include/require statements, enabling attackers to read arbitrary files from the affected server. The vulnerability affects Lella theme versions through 1.2, and while CVSS and EPSS scores are not available, the nature of LFI vulnerabilities typically permits information disclosure of sensitive files such as configuration files, database credentials, and source code. No KEV status or public proof-of-concept has been confirmed in this intelligence dataset, but the vulnerability was reported by Patchstack, a reputable WordPress security researcher.

Technical ContextAI

This vulnerability exploits improper input validation in PHP include/require statements, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The affected product is the Lella WordPress theme by Elated-Themes (CPE: cpe:2.3:a:elated-themes:lella:*:*:*:*:*:*:*:*), which is a server-side template or functionality engine. The root cause is that user-supplied input is not properly sanitized before being passed to PHP file inclusion functions, allowing an attacker to traverse directory paths and include local files on the web server. This is a classic file inclusion vulnerability where an attacker can manipulate parameters such as query strings or POST data to specify arbitrary file paths like '../../../../etc/passwd' or relative paths to sensitive configuration files.

RemediationAI

Website administrators using the Lella theme should immediately update to a patched version beyond 1.2 if one is available from Elated-Themes; check the official Elated-Themes repository or WordPress.org theme directory for updates. If a patched version is unavailable, consider temporarily deactivating or replacing the Lella theme with an alternative until a security update is released. As a complementary mitigation, restrict access to sensitive files by implementing .htaccess rules or web server configuration to block requests to wp-config.php, .env, and other configuration files; additionally, enforce strict input validation and sanitization across all theme functions and disable PHP's allow_url_include and allow_url_fopen directives in php.ini if not required. Monitor access logs for suspicious file inclusion attempts (patterns like ../ or unusual parameter values) and consider deploying a Web Application Firewall (WAF) rule to detect and block LFI payloads.