PHP CVE-2026-22503

ThemeREX Nelson versions <= 1.2.0. Remote unauthenticated attacker can exploit PHP Local File Inclusion via improper filename control in include/require statements. Requires knowledge of target file paths and specific vulnerable parameter manipulation. AC:H indicates non-trivial exploitation complexity.

Despite the absence of a CVSS score and EPSS probability metric, this vulnerability carries moderate to high real-world risk. The attack vector is likely network-based with low or no privilege requirements (typical for WordPress theme vulnerabilities), and LFI exploitation is highly automatable—standard tools can enumerate and extract files without complex exploitation logic. The information disclosure impact is significant; attackers can read configuration files (wp-config.php containing database credentials), theme files, and potentially sensitive user data. The public disclosure via Patchstack and the presence of a detailed CVE record suggest awareness in exploit communities, and POC development for LFI flaws is trivial. The lack of CVSS/EPSS metrics should not be interpreted as low risk; this is a genuine priority for any WordPress administrator running Nelson ≤1.2.0.

An attacker discovers that the Nelson theme processes user input through an unvalidated filename parameter in its template or settings handler. By crafting a request with path traversal sequences (e.g., ?file=../../../../wp-config.php), the attacker causes the theme to include and execute the sensitive configuration file, revealing database credentials and authentication keys. Alternatively, the attacker includes system files (/etc/passwd on Linux) to gather information for privilege escalation attacks. No authentication is required, making this trivial to exploit at scale across vulnerable WordPress instances.