What is the CVSS score of CVE-2026-22515?

CVE-2026-22515 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22515?

CVE-2026-22515 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22515?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22515

EUVD-2026-15530 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-p82f-f9j2-69q4

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15530

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in AncoraThemes VegaDays WordPress theme through version 1.2.0, allowing improper control of filenames in PHP include/require statements. Attackers can leverage this vulnerability to read arbitrary files from the affected server, potentially disclosing sensitive configuration files, database credentials, and other confidential data. While no CVSS score or EPSS data is currently available and KEV status is unknown, the vulnerability is classified as an information disclosure issue with a straightforward exploitation path typical of LFI vulnerabilities in WordPress themes.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic web application flaw where user-supplied input is not properly sanitized before being passed to PHP's include(), require(), include_once(), or require_once() functions. The affected product, AncoraThemes VegaDays (identified via CPE cpe:2.3:a:ancorathemes:vegadays:*:*:*:*:*:*:*:*), is a WordPress theme that reportedly fails to validate or filter filename parameters, allowing attackers to traverse directory structures and load arbitrary local files. This is distinct from Remote File Inclusion (RFI) but equally dangerous, as it permits access to sensitive local resources such as wp-config.php, /etc/passwd, application source code, and other server-side files.

RemediationAI

Immediately upgrade AncoraThemes VegaDays to the latest patched version beyond 1.2.0 (consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vegadays/vulnerability/wordpress-vegadays-theme-1-2-0-local-file-inclusion-vulnerability for the specific patch release). If an immediate upgrade is not feasible, disable or deactivate the VegaDays theme and switch to an alternative, security-audited WordPress theme. As an interim mitigation, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, ..\, etc.) and PHP file paths in URL parameters, and restrict direct file access at the web server level using .htaccess or nginx configuration to deny access to sensitive files such as wp-config.php. Additionally, enforce the principle of least privilege for the web server process and monitor file access logs for suspicious read attempts.