PHP CVE-2026-22515

AncoraThemes VegaDays WordPress plugin version 1.2.0 and earlier. Remote unauthenticated attacker can exploit via crafted HTTP requests targeting vulnerable file inclusion parameters. Requires the plugin to be installed and activated; no victim interaction needed.

The actual risk posture of this vulnerability is moderate to high despite the absence of CVSS and EPSS scores. The attack vector is likely network-based with low complexity (typical of parameter-based LFI), requiring no authentication or user interaction. The technical impact is confidentiality loss—attackers can read arbitrary files—making this a serious information disclosure threat, particularly for WordPress deployments where wp-config.php contains database credentials. The lack of published CVSS, EPSS, or KEV status suggests this may be a recently discovered or less widely reported vulnerability; however, LFI vulnerabilities in WordPress themes are routinely exploited in the wild and are frequently automated by scanner tools. Organizations running VegaDays should prioritize patching over waiting for additional scoring metrics, as the vulnerability class and affected product type indicate real-world exploitability.

An attacker discovers the VegaDays theme is active on a WordPress site and crafts a request to a vulnerable include/require parameter with a path traversal payload, such as 'index.php?page=../../../../wp-config.php'. The unvalidated parameter is passed directly to a PHP include statement, causing the server to load and parse wp-config.php, exposing the database credentials, authentication keys, and other sensitive configuration data in the response or server logs. The attacker then uses the leaked database credentials to directly access the WordPress database, escalating the attack to account creation, data exfiltration, or malware injection.