CVE-2026-22375: 
WordPress vulnerability analysis and mitigation

CVE-2026-22375 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Impacto Patronus WordPress theme, affecting all versions up to and including 1.2.3. The flaw stems from improper control of filenames used in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on November 30, 2025, and publicly disclosed on February 17–20, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The attack vector is network-based, requiring no authentication or user interaction, though it carries high attack complexity. An attacker can manipulate file path parameters passed to PHP include() or require() functions within the Impacto Patronus theme to load arbitrary files from the server's filesystem, potentially exposing sensitive content such as configuration files or credentials (Patchstack, Feedly). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, including sensitive files such as WordPress wp-config.php (which contains database credentials), potentially enabling complete database takeover. The vulnerability also carries high integrity and availability impacts, meaning attackers could potentially manipulate application behavior or cause denial of service conditions. The scope is limited to the affected server, but credential exposure could facilitate lateral movement to backend databases or other connected systems (Patchstack, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Impacto Patronus theme (version ≤ 1.2.3) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed unsanitized to PHP include() or require() functions.
3. Craft malicious request: Construct an HTTP request that supplies a path-traversal payload (e.g., ../../../../wp-config.php) or other local file path to the vulnerable parameter.
4. Retrieve sensitive files: Submit the crafted request to the target server; if successful, the server will include and render the contents of the targeted file (e.g., database credentials from wp-config.php).
5. Escalate access: Use exposed credentials or configuration data to access the WordPress database, escalate privileges, or pivot to other systems (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files like wp-config.php.
• Logs: Web server access logs showing requests with file path parameters targeting system files (e.g., /etc/passwd, wp-config.php); repeated 200 responses to theme-related endpoints with abnormal query strings.
• File System: Unexpected new files or web shells written to the theme directory or WordPress uploads folder if exploitation is chained with a file write capability.
• Process: Unusual PHP process activity reading files outside the WordPress web root, or unexpected database connection attempts from the web server process.

As of the disclosure date, no official patch from AncoraThemes is available for the Impacto Patronus theme (Patchstack). Patchstack has issued a virtual patch (mitigation rule) to block exploitation attempts for users of its platform. Recommended actions include: (1) replacing or deactivating the Impacto Patronus theme until an official patch is released; (2) deploying a Web Application Firewall (WAF) with rules targeting LFI patterns; (3) implementing strict input validation and sanitization for all file inclusion parameters; and (4) applying the principle of least privilege to web server processes and restricting filesystem permissions to limit exposure of sensitive files (Feedly).

Wordfence included CVE-2026-22375 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as part of broader WordPress ecosystem security coverage (Wordfence Blog). Patchstack, which coordinated the disclosure, emphasized the mass-exploit risk associated with LFI vulnerabilities of this severity class and issued a virtual patch for its users (Patchstack). No significant broader media coverage or notable researcher commentary beyond these sources has been identified.