PHP CVE-2026-22513

AncoraThemes Triompher <= 1.1.0 with PHP Local File Inclusion vulnerability. Remote unauthenticated attacker; requires high attack complexity (AC:H) — likely needs specific server configuration or path traversal payload crafting. No victim interaction needed.

While no CVSS score or EPSS data is available for this CVE, the vulnerability presents a moderate to high real-world risk based on several factors. The attack vector is network-based, requiring no authentication or special privileges, which significantly lowers the barrier to exploitation. The technical impact is information disclosure, allowing attackers to exfiltrate sensitive data such as database credentials, authentication tokens, and system configuration details—data that can enable further attacks. The LFI vulnerability class is well-understood and easy to exploit; no complex exploit chains are required. However, practical impact depends on file system permissions and what sensitive files are accessible via the web server process. The lack of published EPSS data and KEV status suggests either limited public disclosure/awareness or that exploitation has not yet reached widespread adoption. Given that Patchstack has documented this vulnerability and it affects a WordPress theme (widely deployed), the risk should be treated seriously even without high CVSS/EPSS numbers. Organizations running Triompher should prioritize patching or workarounds, particularly if the theme is exposed to untrusted networks.

An attacker discovers a WordPress site using the Triompher theme and identifies a parameter vulnerable to local file inclusion. The attacker crafts a malicious URL with path traversal sequences (for example, appending ../../../../etc/passwd or ../../../../var/www/html/wp-config.php) and sends it to the vulnerable parameter. The server processes the request without proper validation, includes the attacker-specified file, and returns its contents in the HTTP response. The attacker successfully reads the wp-config.php file, obtaining database credentials and authentication keys, and then uses this information to compromise the database, escalate privileges, or conduct further attacks. Since the vulnerability requires only network access and no authentication, any attacker on the internet can attempt exploitation with simple tools or manual requests.