CVE-2026-22425: 
WordPress vulnerability analysis and mitigation

CVE-2026-22425 is a PHP Local File Inclusion (LFI) vulnerability in the Elated-Themes Sweet Jane WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects Sweet Jane versions up to and including 1.2, allowing unauthenticated remote attackers to include and execute arbitrary local PHP files. The vulnerability was published on March 5, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Sweet Jane theme (CWE-98), which maps to CAPEC-193 (PHP Remote File Inclusion). An attacker can manipulate user-supplied input that is passed unsanitized to a PHP file inclusion function, causing the server to include arbitrary files from the local filesystem. No authentication or user interaction is required, though exploitation is rated as high complexity. No public technical write-up or proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows an unauthenticated attacker to read sensitive files from the server (e.g., WordPress configuration files containing database credentials), execute arbitrary PHP code by including writable files with attacker-controlled content, and potentially achieve full server compromise. Confidentiality, integrity, and availability are all rated as HIGH impact, meaning an attacker could exfiltrate credentials, modify application behavior, or disrupt service. In a shared hosting environment, this could also facilitate lateral movement to other hosted sites (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

No patch has been confirmed available for the Sweet Jane theme as of the disclosure date. Administrators should immediately audit WordPress installations for the Sweet Jane theme (versions ≤ 1.2) and consider disabling or removing it if a patched version is unavailable. Deploying Web Application Firewall (WAF) rules to detect and block local file inclusion patterns (e.g., path traversal sequences like ../) is recommended as a compensating control. Additionally, restrict PHP file permissions and ensure sensitive files (e.g., wp-config.php) are not readable by the web server process where possible (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering the period of February 23 to March 1, 2026, indicating routine tracking by the WordPress security community. No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond standard vulnerability database listings (Wordfence).