What is the CVSS score of CVE-2026-22516?

CVE-2026-22516 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22516?

CVE-2026-22516 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-22516?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-22516

EUVD-2026-15532 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-cgg4-m77j-fqhf

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15532

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wizor's wizors-investments allows PHP Local File Inclusion.This issue affects Wizor's: from n/a through <= 2.12.

AnalysisAI

AncoraThemes Wizor's investment theme for WordPress versions through 2.12 contains a Local File Inclusion (LFI) vulnerability that allows attackers to include and execute arbitrary local files on the server through improper handling of filename parameters in PHP include/require statements. This vulnerability enables information disclosure and potential remote code execution depending on server configuration and available files. While no CVSS score or EPSS data has been assigned, the vulnerability is tracked in the ENISA EUVD database (EUVD-2026-15532) and was reported by Patchstack, indicating active security research and likely proof-of-concept availability.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic web application flaw where user-supplied input is passed directly to PHP's include() or require() functions without adequate sanitization or validation. The affected product is AncoraThemes Wizor's (CPE: cpe:2.3:a:ancorathemes:wizor's:*:*:*:*:*:*:*:*), a WordPress theme that processes filename parameters insecurely. In a Local File Inclusion scenario, an attacker manipulates these parameters to reference files outside the intended directory (e.g., using path traversal sequences like '../'), allowing access to sensitive server files such as configuration files, system files, or uploaded content. If the server is configured to execute PHP files from unexpected locations, or if log files or session data contain attacker-controlled content, this can escalate to Remote Code Execution (RCE).

RemediationAI

Immediately upgrade AncoraThemes Wizor's theme to the latest available version greater than 2.12 if a patch has been released by the vendor; verify availability at the official AncoraThemes website or WordPress theme repository. If a patch is not yet available, disable the Wizor's theme and substitute an alternative, well-maintained WordPress theme to eliminate exposure. As an interim mitigation, implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., '../', '..\', '%2e%2e', etc.) in theme-related parameters, and restrict file_get_contents() and include/require functions in PHP configuration if possible. Monitor access logs for suspicious patterns indicative of LFI exploitation attempts targeting the theme's vulnerable parameters.