CVE-2026-22362: 
WordPress vulnerability analysis and mitigation

CVE-2026-22362 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Photolia WordPress theme, affecting all versions through 1.0.3. The flaw stems from improper control of filename parameters in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include and execute arbitrary local files. It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on November 30, 2025, and published on February 17–20, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The Photolia WordPress theme fails to properly validate or sanitize user-supplied input used in PHP include or require statements, allowing an attacker to manipulate the file path parameter to reference arbitrary files on the server. Exploitation requires no authentication and is achievable over the network, though attack complexity is rated High, suggesting some precondition such as specific server configuration or parameter guessing is involved. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the web server, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), /etc/passwd, or other server-side files. If the attacker can control file content (e.g., via log poisoning or uploaded files), LFI can escalate to remote code execution, resulting in complete system compromise with high impact to confidentiality, integrity, and availability. This type of vulnerability is commonly leveraged in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Patchstack, Feedly).

No public proof-of-concept exploit has been observed, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.115%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns against WordPress installations (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Photolia theme (version ≤ 1.0.3) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the file inclusion parameter that is not properly sanitized in include/require calls.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated file path parameter (e.g., ?file=../../../../wp-config.php or path traversal sequences) targeting sensitive local files.
4. Extract sensitive data: Review the server response for included file contents, such as database credentials from wp-config.php or system files like /etc/passwd.
5. Escalate to RCE (optional): If file upload is possible or server logs are accessible, inject PHP code into an includable file (log poisoning) and include it via the LFI vector to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET/POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) or references to sensitive files (wp-config.php, passwd, etc) in query parameters.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded traversal patterns or unexpected file path strings in theme-related URL parameters; PHP error logs referencing failed or successful file inclusion of unexpected paths.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme folder; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following suspicious HTTP requests to the Photolia theme endpoints.

As of the disclosure date, no official patch from axiomthemes is available for the Photolia theme beyond version 1.0.3. Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for subscribers. Recommended interim mitigations include: disabling allow_url_include and allow_url_fopen in php.ini, deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns, restricting access to the WordPress installation at the network level, and monitoring for suspicious file inclusion activity. Site owners should monitor the Photolia theme's official repository for a patched release and upgrade immediately when available (Patchstack, Feedly).

Wordfence included CVE-2026-22362 in its weekly WordPress vulnerability report covering February 16–22, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack credited the discovery to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and classified it as high priority, noting the potential for mass-exploit campaigns. No significant additional researcher commentary or social media discussion has been identified beyond standard vulnerability database aggregation (Wordfence, Patchstack).