PHP CVE-2026-22508

Remote attacker targeting AncoraThemes Dentalux versions <= 3.3. Requires the vulnerable PHP include/require parameter to be exposed and accessible without authentication. AC:H suggests special path manipulation or specific server configuration needed to achieve file inclusion.

Despite the absence of a CVSS score or EPSS metric, this vulnerability represents a material security risk based on multiple signals: it is tagged as an LFI vulnerability (a well-understood and frequently exploited attack class), affects a WordPress theme (high internet exposure), impacts all versions through 3.3 (potentially affecting numerous deployed instances), and enables information disclosure. The lack of a CVSS vector suggests this may be a recently disclosed or unscored vulnerability rather than a low-severity issue. LFI vulnerabilities are typically automatable (high SSVC automatable score), allow unauthenticated exploitation (low privilege requirement), and have high technical impact (file disclosure, potential RCE via log poisoning or wrapper exploitation). Given the widespread deployment of WordPress themes and the mature exploitation techniques for LFI, this should be treated as a medium-to-high priority remediation target, especially for public-facing sites.

An unauthenticated attacker visiting a website running Dentalux theme version 3.3 or earlier could craft a malicious URL parameter targeting an unvalidated include/require statement in the theme code (for example, by manipulating a 'file' or 'page' parameter). The attacker could then include sensitive local files such as /etc/passwd (to enumerate system users) or wp-config.php (to extract database credentials), or use techniques like log poisoning (injecting PHP code into access logs via a User-Agent header and then including the log file) to achieve remote code execution. This attack requires only a web browser and knowledge of the vulnerable parameter, making it highly practical for automated scanning tools.