CVE-2026-22402: 
WordPress vulnerability analysis and mitigation

CVE-2026-22402 is a Local File Inclusion (LFI) vulnerability in the Triply WordPress theme developed by pavothemes. It stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing authenticated attackers to include arbitrary local files. All versions of the Triply theme up to and including 2.4.7 are affected. The vulnerability was published on January 22, 2026, with a CVSS v3.1 base score of 7.5 (High), as assessed by CISA-ADP (Feedly, Patchstack).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly referred to as PHP Remote File Inclusion, though in this case the exploitation is limited to local file inclusion. The vulnerability arises when user-supplied input is passed unsanitized to PHP's include or require constructs within the Triply theme, enabling an attacker to manipulate the file path parameter to reference arbitrary files on the server. Exploitation requires low-level authenticated access (e.g., a subscriber or contributor account) and high attack complexity, suggesting some preconditions such as specific server configurations or parameter exposure must be met (Feedly, Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the server (e.g., WordPress configuration files such as wp-config.php containing database credentials), and under certain conditions may enable remote code execution by including files with attacker-controlled content (e.g., uploaded image files containing PHP code). The CVSS assessment reflects high impacts to confidentiality, integrity, and availability, indicating that full system compromise is theoretically achievable. Exposure of database credentials could further enable lateral movement to backend databases or other connected systems (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for CVE-2026-22402 at this time. The EPSS score is approximately 0.053% (0.000530), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites using the Triply theme (version ≤ 2.4.7) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source.
2. Authentication: Obtain low-privilege credentials (e.g., subscriber or contributor account) on the target WordPress site, either through registration, credential stuffing, or phishing.
3. Identify vulnerable parameter: Locate the theme's PHP include/require functionality that accepts user-controlled file path input, typically exposed via a theme template, shortcode, or AJAX handler.
4. Craft malicious request: Submit an HTTP request with a manipulated file path parameter using directory traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
5. Extract sensitive data: Parse the server response to retrieve the contents of included files such as wp-config.php, which may contain database credentials, secret keys, and other sensitive configuration data.
6. Escalate (optional): If the server permits inclusion of uploaded files, upload a PHP web shell disguised as an image, then include it via the LFI vector to achieve remote code execution (Feedly, Patchstack).

• Network: HTTP requests to WordPress endpoints containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields associated with the Triply theme.
• Logs: Web server access logs showing requests with path traversal patterns targeting theme-related endpoints; repeated 200 responses to requests referencing sensitive files like wp-config.php.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory (/wp-content/uploads/) with .php extensions or double extensions (e.g., .php.jpg).
• Process: Unusual PHP child processes spawned by the web server process (e.g., curl, wget, bash) that may indicate post-exploitation activity following successful LFI-to-RCE escalation.

Users of the Triply WordPress theme should update to a version beyond 2.4.7 as soon as a patched release is made available by pavothemes. In the interim, site administrators should restrict access to the WordPress admin and theme functionality to trusted IP addresses where possible, and disable user registration if not required to reduce the attack surface. Web application firewalls (WAFs) can be configured with rules to detect and block directory traversal patterns in HTTP requests. Monitoring web server logs for traversal sequences is also recommended as a detective control (Patchstack).

The vulnerability was reported by Patchstack, which assigned and disclosed the CVE on January 22, 2026. Wordfence referenced this vulnerability in their weekly WordPress vulnerability report covering the period of December 15, 2025 to January 4, 2026. No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been identified (Wordfence, Patchstack).