CVE-2026-22373: 
WordPress vulnerability analysis and mitigation

CVE-2026-22373 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Fooddy WordPress theme, affecting all versions through 1.3.10. It stems from improper control of filename parameters in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported on November 30, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published on February 17–20, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), but the actual exploitation is Local File Inclusion (LFI). The flaw exists because the Fooddy WordPress theme passes user-controlled input directly into PHP include or require statements without adequate sanitization or validation, enabling an attacker to manipulate the filename parameter to reference arbitrary files on the server. No authentication is required to trigger the vulnerability, and exploitation requires high attack complexity per the CVSS vector. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the web server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability has high impact on confidentiality, integrity, and availability — attackers could leverage exposed credentials for lateral movement, escalate to remote code execution if combined with file upload or log poisoning techniques, and disrupt site availability. Patchstack notes this class of vulnerability is commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

As of the time of reporting, no public proof-of-concept exploit exists and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns it is the type of vulnerability commonly leveraged in mass WordPress exploit campaigns (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Fooddy theme (version ≤ 1.3.10) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the endpoint and parameter that passes user input to a PHP include or require statement without sanitization.
3. Craft LFI payload: Construct an HTTP request with a manipulated filename parameter (e.g., ?file=../../../../wp-config.php or using null byte/path traversal sequences) targeting the vulnerable endpoint.
4. Extract sensitive files: Submit the crafted request and observe the server response for the contents of targeted files such as wp-config.php (database credentials), /etc/passwd, or PHP session files.
5. Escalate if possible: If the server allows log file inclusion or file uploads, chain the LFI with log poisoning or a malicious uploaded file to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to Fooddy theme endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, %00) in filename-related parameters; repeated requests to theme PHP files from a single IP.
• Logs: Web server access logs showing requests with encoded path traversal strings targeting theme files; HTTP 200 responses to requests containing wp-config, passwd, or other sensitive file names in query parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or PHP session files coinciding with suspicious web requests.
• Process: PHP processes spawning unexpected child processes (indicative of LFI-to-RCE escalation via log poisoning or file upload chaining) (Patchstack).

No official patch from AncoraThemes is available as of the disclosure date; the vulnerable version remains ≤ 1.3.10. Patchstack has issued a virtual patch (mitigation rule) to block exploitation attempts for users of its platform. Recommended interim mitigations include: (1) disabling or removing the Fooddy theme if not critical; (2) setting PHP's open_basedir directive to restrict file access; (3) disabling allow_url_include and allow_url_fopen in php.ini; (4) implementing a Web Application Firewall (WAF) rule to block path traversal patterns; and (5) monitoring web server logs for suspicious file inclusion attempts. Users should upgrade to a patched version as soon as one is released by the vendor (Patchstack, Feedly).

Patchstack included CVE-2026-22373 in its weekly WordPress vulnerability intelligence report for the week of February 16–22, 2026, flagging it as high priority due to the potential for mass exploitation campaigns targeting WordPress sites. The vulnerability was credited to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who responsibly disclosed it through Patchstack's coordinated disclosure process. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability aggregator coverage (Patchstack, Wordfence Blog).