What is the CVSS score of CVE-2026-22509?

CVE-2026-22509 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22509?

CVE-2026-22509 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22509?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22509

EUVD-2026-15518 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-j6rf-m77h-vwcj

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15518

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.This issue affects Gioia: from n/a through <= 1.4.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Elated-Themes Gioia WordPress theme through version 1.4, allowing improper control of filenames in PHP include/require statements. Attackers can leverage this vulnerability to read sensitive local files from the affected web server, potentially disclosing configuration files, database credentials, or other confidential information. The vulnerability affects all installations of Gioia version 1.4 and earlier, with no CVSS or EPSS scoring data currently available, though the CWE-98 classification and LFI nature suggest moderate to high practical risk.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of flaws where user-supplied input is used unsanitized in PHP include(), require(), include_once(), or require_once() functions. The Gioia theme (identified via CPE cpe:2.3:a:elated-themes:gioia:*:*:*:*:*:*:*:*) improperly handles filename inputs, permitting attackers to manipulate file paths to include arbitrary local files from the server filesystem. Unlike Remote File Inclusion (RFI), which fetches files from external URLs, this LFI variant restricts attacks to files accessible by the web server process on the local filesystem, but remains dangerous for information disclosure and potential code execution if writable file uploads or log poisoning are combined.

RemediationAI

Immediately upgrade the Gioia theme to a version newer than 1.4 if available from Elated-Themes, or discontinue use of the theme and switch to an actively maintained alternative. Consult the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Theme/gioia/vulnerability/wordpress-gioia-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve) for patch availability and timeline updates. As interim mitigation, implement Web Application Firewall (WAF) rules to block requests containing common LFI path traversal patterns (e.g., sequences like ../, ..\ or encoded variants %2e%2e%2f), restrict file access via web server configuration to block direct access to sensitive directories (wp-config.php, etc.), and apply the principle of least privilege to the web server process user account to limit the scope of readable files.