CVE-2026-22368: 
WordPress vulnerability analysis and mitigation

CVE-2026-22368 is a Local File Inclusion (LFI) vulnerability in the axiomthemes Redy WordPress theme, affecting versions 1.0.2 and earlier. It stems from improper control of filename parameters in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on November 30, 2025, and published on February 17–20, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized into PHP include or require statements within the Redy theme. An unauthenticated attacker can craft a malicious HTTP request that manipulates the filename parameter to traverse the file system and include arbitrary local PHP files. Exploitation requires high attack complexity but no privileges or user interaction, and the attack vector is network-accessible (Patchstack, Feedly).

Successful exploitation allows an attacker to read sensitive local files — such as WordPress configuration files containing database credentials (wp-config.php) — potentially enabling complete database takeover. High confidentiality, integrity, and availability impacts are possible: attackers can expose credentials, modify application behavior by executing included PHP files, and disrupt service availability. The scope is limited to the affected server, but credential exposure could facilitate lateral movement to connected database systems (Patchstack, Feedly).

As of the time of publication, no public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.115%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI, CVSS 8.1, unauthenticated) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Redy theme (version ≤ 1.0.2) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that accepts unsanitized user input in an include/require statement.
3. Craft malicious request: Construct an HTTP GET or POST request targeting the vulnerable endpoint, supplying a path traversal payload (e.g., ../../../../wp-config.php) in the filename parameter.
4. Extract sensitive data: If the included file is a PHP file with readable output (e.g., configuration files), the server will render its contents, exposing database credentials, secret keys, or other sensitive configuration data.
5. Escalate access: Use extracted database credentials to connect to the WordPress database directly, enabling full site takeover, user credential harvesting, or further lateral movement (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields targeting the Redy theme endpoints.
• Logs: Web server access logs showing requests with encoded traversal strings or references to sensitive files (e.g., wp-config.php, /etc/passwd) in parameter values; repeated 200 responses to such requests.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system files like /etc/passwd.
• Application: PHP error logs showing file inclusion failures for non-existent traversal paths, which may indicate probing activity (Patchstack).

No official patch from axiomthemes is currently available for the Redy theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. As immediate workarounds: disable or replace the Redy theme if possible; implement input validation and whitelisting for file inclusion parameters at the application or WAF level; disable PHP's allow_url_include and allow_url_fopen directives if not required; and restrict file system permissions to limit accessible files. Site owners should monitor axiomthemes for an updated theme release and apply it promptly (Patchstack, Feedly).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as part of a broader set of WordPress theme and plugin vulnerabilities. Patchstack classified it as high priority, noting that LFI vulnerabilities of this severity are commonly leveraged in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity. No significant vendor statement from axiomthemes or notable individual researcher commentary beyond the initial discovery credit has been identified (Wordfence, Patchstack).