What is the CVSS score of CVE-2026-22502?

CVE-2026-22502 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22502?

CVE-2026-22502 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22502?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22502

EUVD-2026-15509 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-654x-phqm-38q6

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15509

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mr. Cobbler mr-cobbler allows PHP Local File Inclusion.This issue affects Mr. Cobbler: from n/a through <= 1.1.9.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in AncoraThemes Mr. Cobbler WordPress theme through version 1.1.9, stemming from improper control of filenames in PHP include/require statements (CWE-98). An attacker can exploit this vulnerability to disclose sensitive local files from the affected server by manipulating include parameters. While no CVSS score or EPSS data is currently available and KEV status is unknown, the vulnerability is classified as high-severity due to its information disclosure impact and the ease with which LFI vulnerabilities are typically exploited.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP-specific weakness where user-controlled input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. AncoraThemes Mr. Cobbler, identified by CPE cpe:2.3:a:ancorathemes:mr._cobbler:*:*:*:*:*:*:*:*, is a WordPress theme that fails to properly validate or sanitize filename parameters before using them in file inclusion statements. This allows attackers to traverse the filesystem (using path traversal sequences like '../' or absolute paths) or exploit PHP stream wrappers (like file://, php://, or filter://) to include arbitrary files such as configuration files, logs, or source code. The vulnerability is particularly dangerous in WordPress environments where sensitive configuration files (wp-config.php) contain database credentials.

RemediationAI

Immediately upgrade AncoraThemes Mr. Cobbler to a version newer than 1.1.9 if available from the vendor (check AncoraThemes official website or WordPress.org theme repository for patched releases). If an upgrade is not immediately available, disable or uninstall the Mr. Cobbler theme and switch to an alternative WordPress theme. As a temporary mitigation, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences ('../', '..\\', encoded variants) and PHP stream wrapper prefixes ('file://', 'php://', 'filter://') in GET and POST parameters. Additionally, restrict file permissions on sensitive files like wp-config.php to read-only for the web server process, disable PHP execution in upload directories via .htaccess or web server configuration, and monitor application logs for suspicious file inclusion attempts. Apply principle of least privilege to WordPress file and directory ownership.