What is the CVSS score of EUVD-2026-15514?

EUVD-2026-15514 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15514?

CVE-2026-22506 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate EUVD-2026-15514?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-15514

| CVE-2026-22506 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-pmxw-wq2p-4mmj

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15514

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Amoli amoli allows PHP Local File Inclusion.This issue affects Amoli: from n/a through <= 1.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Elated-Themes Amoli WordPress theme version 1.0 and earlier, stemming from improper control of filenames in PHP include/require statements. An attacker can exploit this weakness to read arbitrary files from the affected server, potentially disclosing sensitive configuration files, database credentials, or other confidential information. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has been documented by Patchstack with ENISA EUVD identifier EUVD-2026-15514.

Technical ContextAI

The vulnerability resides in the Elated-Themes Amoli WordPress theme (CPE: cpe:2.3:a:elated-themes:amoli:*:*:*:*:*:*:*:*) and affects versions up to and including 1.0. The root cause is classified under CWE-98, which describes improper validation and sanitization of user-supplied input that is passed directly to PHP's include() or require() functions without adequate filtering. In WordPress theme contexts, this typically occurs when user-controllable parameters (such as query strings or POST data) are used to construct file paths without proper validation against directory traversal sequences (../) or absolute path specifications. The vulnerability allows an attacker to manipulate the filename parameter to traverse the filesystem and include arbitrary files, such as /etc/passwd, wp-config.php, or other sensitive files accessible to the web server process.

RemediationAI

Immediately update the Elated-Themes Amoli theme to the latest patched version released by the vendor; if no patch is available, disable or remove the vulnerable theme until an update is provided. Site administrators should verify the exact version running via the WordPress theme administration panel and check the official Elated-Themes website or Patchstack for available patches. As an interim mitigation, restrict access to the WordPress installation using Web Application Firewall (WAF) rules to block requests containing directory traversal sequences such as ../ or encoded variants, and implement strict file inclusion policies at the application layer. Monitor server logs for suspicious include/require activity and consider using security plugins that enforce strict file access controls on WordPress installations.