What is the CVSS score of EUVD-2026-15511?

EUVD-2026-15511 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15511?

CVE-2026-22503 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate EUVD-2026-15511?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-15511

| CVE-2026-22503 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-gw5q-g722-hr5x

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15511

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nelson nelson allows PHP Local File Inclusion.This issue affects Nelson: from n/a through <= 1.2.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Nelson WordPress theme through version 1.2.0, allowing attackers to read arbitrary files from the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure attacks without authentication. While no CVSS score or EPSS data is currently available, the LFI classification and public disclosure via Patchstack indicate this is a genuine security concern affecting WordPress installations using vulnerable Nelson theme versions.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-supplied input is passed unsanitized to PHP's include() or require() functions. The ThemeREX Nelson theme (identified via CPE cpe:2.3:a:themerex:nelson:*:*:*:*:*:*:*:*) fails to properly validate or sanitize filename parameters before including them, enabling attackers to manipulate file paths to access sensitive files outside the intended directory structure. This occurs within a WordPress plugin or theme context, leveraging WordPress's template loading mechanism to execute the vulnerable code paths.

RemediationAI

Immediately upgrade the ThemeREX Nelson theme to a patched version beyond 1.2.0 if available from the vendor. Verify the patch status by checking the official ThemeREX website or the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/nelson/vulnerability/wordpress-nelson-theme-1-2-0-local-file-inclusion-vulnerability?_s_id=cve. As an interim mitigation, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, etc.) in query parameters and POST data. Additionally, restrict direct file access to sensitive configuration files using .htaccess rules (e.g., blocking access to wp-config.php) and review WordPress file permissions to ensure the web server process runs with minimal necessary privileges. Monitor WordPress access logs for suspicious include/require patterns and consider temporarily disabling the Nelson theme in favor of an alternative until a patch is deployed.