What is the CVSS score of CVE-2026-22513?

CVE-2026-22513 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22513?

CVE-2026-22513 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22513?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22513

EUVD-2026-15526 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-c73f-69w2-473j

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15526

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Triompher triompher allows PHP Local File Inclusion.This issue affects Triompher: from n/a through <= 1.1.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in AncoraThemes Triompher WordPress theme versions up to and including 1.1.0, caused by improper control of filename parameters in PHP include/require statements. An unauthenticated attacker can exploit this vulnerability to read arbitrary files from the server, leading to information disclosure of sensitive data such as configuration files, database credentials, and other system files. No CVSS score, EPSS data, or known exploitation in the wild (KEV status) has been published, but the vulnerability is confirmed and documented by Patchstack with an available reference.

Technical ContextAI

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and manifests as a Local File Inclusion (LFI) flaw. The affected product is AncoraThemes Triompher (CPE: cpe:2.3:a:ancorathemes:triompher:*:*:*:*:*:*:*:*), a WordPress theme. The root cause is the failure to properly validate or sanitize user-supplied input before passing it to PHP file inclusion functions (include(), require(), include_once(), or require_once()). This allows attackers to manipulate file paths and access files outside the intended directory scope, such as /etc/passwd, wp-config.php, or other sensitive system and application files. The vulnerability affects all versions from the initial release through version 1.1.0, indicating it has persisted across multiple release cycles without remediation.

RemediationAI

The primary remediation is to upgrade AncoraThemes Triompher to a patched version beyond 1.1.0 if available from the vendor. If a patched version is not yet available, immediately disable or remove the Triompher theme from production and replace it with a maintained, secure alternative theme. As a temporary workaround pending patch availability, restrict access to the WordPress application using a web application firewall (WAF) to block requests containing path traversal patterns (such as ../, etc/passwd, or common file paths), enforce strict input validation on all user-supplied parameters, and limit file system permissions for the web server process to the absolute minimum required. Additionally, monitor server logs for suspicious file inclusion attempts and ensure that sensitive files such as wp-config.php are protected by additional access controls. Organizations should also conduct a security audit to determine what files may have been accessed if the vulnerability has been exploited. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/triompher/vulnerability/wordpress-triompher-theme-1-1-0-local-file-inclusion-vulnerability for vendor-provided patches and updates as they become available.