What is the CVSS score of CVE-2026-22511?

CVE-2026-22511 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22511?

CVE-2026-22511 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22511?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22511

EUVD-2026-15522 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-99q6-r5mp-6h38

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15522

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes NeoBeat neobeat allows PHP Local File Inclusion.This issue affects NeoBeat: from n/a through <= 1.2.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Elated-Themes NeoBeat WordPress theme through version 1.2, allowing attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability enables information disclosure attacks where an attacker can access sensitive files such as configuration files, database credentials, and source code without requiring authentication or special privileges. This is a CWE-98 vulnerability that transforms what was initially reported as PHP Remote File Inclusion (RFI) into a confirmed Local File Inclusion attack vector.

Technical ContextAI

The vulnerability stems from improper input validation in PHP include or require statements within the NeoBeat theme code. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) occurs when user-supplied input is directly used in filesystem operations without sanitization or whitelisting, allowing attackers to traverse directory structures and access unintended files. The affected product is identified via CPE as cpe:2.3:a:elated-themes:neobeat:*:*:*:*:*:*:*:*, indicating the entire NeoBeat product line through version 1.2 is vulnerable. WordPress theme contexts are particularly sensitive because themes often handle user-supplied parameters in URL query strings, POST data, or other HTTP inputs that may be passed directly to file inclusion functions without proper validation.

RemediationAI

Immediately upgrade the NeoBeat theme to a patched version newer than 1.2 if available from Elated-Themes, or disable and remove the theme if no patch is available. Users should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/neobeat/vulnerability/wordpress-neobeat-theme-1-2-local-file-inclusion-vulnerability) for patch availability status and timelines. As a temporary mitigation, implement Web Application Firewall (WAF) rules to block common LFI payloads including directory traversal sequences (../, ..\, etc.) and null byte injection attempts, restrict file permissions on sensitive configuration files (wp-config.php) to minimize exposure if accessed, and monitor web server access logs for suspicious file inclusion requests (patterns like php://filter, php://input, or multiple consecutive ../ sequences). WordPress administrators should also audit recent access logs and consider rotating any exposed credentials.