What is the CVSS score of EUVD-2026-15495?

EUVD-2026-15495 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15495?

CVE-2026-22493 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate EUVD-2026-15495?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-15495

| CVE-2026-22493 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-2vx4-g966-c828

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15495

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gaspard gaspard allows PHP Local File Inclusion.This issue affects Gaspard: from n/a through <= 1.3.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Elated-Themes Gaspard WordPress theme through version 1.3, stemming from improper control of filenames in PHP include/require statements. An unauthenticated attacker can exploit this vulnerability to read arbitrary files from the affected server, potentially disclosing sensitive information such as configuration files, database credentials, or other sensitive data. The vulnerability affects all versions up to and including 1.3, and while no CVSS score or EPSS data is currently published, the LFI classification and information disclosure impact indicate this requires prompt remediation.

Technical ContextAI

This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a well-established attack vector in PHP-based applications. The root cause involves insufficient input validation or sanitization on user-supplied parameters that are subsequently passed to PHP's include() or require() functions. The affected product is the Gaspard WordPress theme (CPE: cpe:2.3:a:elated-themes:gaspard:*:*:*:*:*:*:*:*), which is a theme component that runs within the WordPress content management system. When user input is not properly filtered, an attacker can manipulate file path parameters to traverse the filesystem and access files outside the intended directory, such as /etc/passwd, wp-config.php, or other sensitive resources. This is a PHP-specific vulnerability class that has been prevalent for decades but remains exploitable when input validation is overlooked.

RemediationAI

The primary remediation is to upgrade the Gaspard theme to a patched version released after version 1.3; administrators should check the Elated-Themes official repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/gaspard/vulnerability/wordpress-gaspard-theme-1-3-local-file-inclusion-vulnerability for available patches and upgrade instructions. If no patch is immediately available, immediately disable the Gaspard theme and switch to an alternative, security-reviewed WordPress theme to eliminate the attack surface. As an interim mitigation, implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (such as ../, ..\, or encoded variants) in URL parameters known to be processed by the theme; additionally, restrict PHP's file access via php.ini open_basedir directive and disable dangerous functions like include() and require() where feasible. Monitor web server logs for suspicious file inclusion attempts and audit the WordPress installation for signs of compromise. Once a patch is confirmed available from Elated-Themes, prioritize testing and deployment in a staging environment before production rollout.