PHP CVE-2026-22516

Requires AncoraThemes Wizor plugin version <= 2.12 with PHP configured to allow file inclusion. Remote unauthenticated attacker must craft malicious request targeting vulnerable include/require statement. No victim interaction needed; exploitation occurs server-side during request processing.

Although no CVSS vector or EPSS score is available, the risk assessment can be synthesized from available signals: the vulnerability affects a WordPress theme (widely deployed), impacts versions through 2.12 (suggests a common version in use), and enables Local File Inclusion with direct information disclosure capability. The CWE-98 classification is a known attack vector requiring no special privileges in most WordPress contexts. The absence of CVSS/EPSS data is notable—it may indicate the vulnerability was discovered and reported recently (post-2024 CVE database delays) or that official metrics are pending. Per SSVC decision logic, this vulnerability likely scores as Immediate or Soon priority: exploitation is likely automatable (path traversal is trivial), technical impact is significant (information disclosure and potential RCE), and the affected software is widely deployed in WordPress ecosystems. The ENISA EUVD assignment and Patchstack reporting confirm legitimate security community attention. Real-world priority is HIGH for WordPress administrators running Wizor's theme, as LFI vulnerabilities are routinely exploited in the wild.

An attacker crafts a malicious URL targeting a vulnerable Wizor's theme parameter (e.g., https://target.com/?theme_file=../../../../etc/passwd) and submits it via a browser or automated tool. The vulnerable theme code directly passes the unsanitized theme_file parameter to a PHP include() or require() statement, causing the server to read and potentially output the contents of /etc/passwd or other sensitive files. If the theme processes output as HTML, the attacker gains direct information disclosure; if the server configuration allows PHP execution from an unexpected path, the attacker can escalate to remote code execution by including a file they control (e.g., an uploaded image with embedded PHP code). Exploitation requires only HTTP access and no authentication, making this a high-impact, trivially exploitable vulnerability.