CVE-2026-22344: 
WordPress vulnerability analysis and mitigation

CVE-2026-22344 is a Local File Inclusion (LFI) vulnerability in the Mikado-Themes FiveStar WordPress theme affecting all versions up to and including 1.7. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on November 29, 2025, and published by Patchstack on February 11, 2026, with NVD publication on February 20, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion attacks. The root cause is insufficient validation and sanitization of user-supplied input that is passed directly to PHP include or require statements within the FiveStar theme, allowing an attacker to manipulate the filename parameter to reference arbitrary files on the server. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass technique is needed to reliably trigger the vulnerability. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary local files on the web server, with potential impacts spanning all three security pillars. Sensitive files such as WordPress configuration files (wp-config.php) containing database credentials could be read, enabling complete database takeover. Depending on server configuration, attackers may also achieve arbitrary code execution with the privileges of the web server process, potentially leading to full application and system compromise (Patchstack, Feedly).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been confirmed as of the time of reporting (Feedly). The EPSS score is approximately 0.053%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the FiveStar theme (version ≤ 1.7) via passive techniques such as HTTP response headers, HTML source inspection, or tools like WPScan.
2. Identify vulnerable parameter: Locate the theme's PHP endpoint or template that accepts a user-controlled filename parameter passed to an include or require statement.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated filename parameter (e.g., path traversal sequences like ../../../../wp-config.php) targeting the vulnerable include logic.
4. Retrieve sensitive files: If successful, the server returns the contents of the targeted local file (e.g., wp-config.php), exposing database credentials, secret keys, and other sensitive configuration data.
5. Escalate access: Use extracted credentials to access the WordPress database directly or authenticate to the WordPress admin panel, enabling further compromise such as webshell upload or lateral movement (Patchstack).

• Network: Unusual HTTP GET or POST requests to FiveStar theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files like wp-config.php, /etc/passwd.
• Logs: Web server access logs showing requests with encoded or decoded path traversal patterns targeting theme PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected new files (e.g., webshells with .php extension) in the WordPress theme directory or uploads folder following exploitation.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate post-exploitation activity.

As of the time of reporting, no official patch from the theme developer (Mikado-Themes/Qode Interactive) is available for FiveStar version 1.7 or earlier (Patchstack). Patchstack has issued a virtual patch (mitigation rule) for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) Monitor the FiveStar theme repository for an updated version and upgrade immediately when available; (2) Deploy a Web Application Firewall (WAF) with rules targeting LFI patterns; (3) Implement strict server-side input validation and whitelist-based file inclusion; (4) Consider temporarily deactivating the theme if exposure is a concern and no WAF is in place.

Patchstack, which discovered and disclosed the vulnerability through researcher Tran Nguyen Bao Khanh, classified it as high priority and noted its potential for use in mass-exploit campaigns against WordPress sites (Patchstack). The vulnerability was also referenced in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of February 9–15, 2026 (Wordfence). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.