PHP CVE-2026-22502

Remote unauthenticated attacker exploiting Local File Inclusion in AncoraThemes Mr. Cobbler <= 1.1.9. Requires crafted request with malicious file path parameter. AC:H indicates special conditions (non-default configuration or specific parameter manipulation) needed for successful exploitation.

Despite the absence of a CVSS score and EPSS exploitation probability score in the provided data, this vulnerability carries significant real-world risk. LFI vulnerabilities are highly exploitable with low attack complexity—typically requiring only HTTP GET/POST parameters and no authentication—placing them in the high-risk category. The attack vector is network-based and requires minimal user interaction. The primary impact is confidentiality/information disclosure rather than immediate code execution, yet information disclosure is a critical stepping stone to further attacks (e.g., obtaining credentials, discovering additional vulnerabilities, or reading source code). The lack of published CVSS and EPSS metrics may indicate this is a recent disclosure or community-sourced report; however, the presence of Patchstack reporting and ENISA EUVD tracking (EUVD-2026-15509) confirms official recognition. The searchable Patchstack database reference suggests proof-of-concept or vulnerability details are publicly available, elevating exploitation likelihood. This is a genuine priority issue requiring immediate patching in production WordPress installations running Mr. Cobbler.

An attacker crafts a malicious URL targeting the Mr. Cobbler theme's vulnerable include parameter, such as 'http://target.com/?include=../../../../etc/passwd' or using a filter stream wrapper to encode and read wp-config.php containing database credentials. The attack requires only network access and no authentication, making it exploitable by unauthenticated remote attackers. Once sensitive files are disclosed, the attacker gains credentials or discovers further vulnerabilities for lateral movement or privilege escalation. Proof-of-concept code or ready-to-use exploits are likely available in public databases given Patchstack's public reporting.