CVE-2026-22449: 
WordPress vulnerability analysis and mitigation

CVE-2026-22449 is a PHP Local File Inclusion (LFI) vulnerability in the "Don Peppe" WordPress theme developed by Select-Themes. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing unauthenticated network attackers to include arbitrary local files on the server. All versions of the Don Peppe theme through 1.3 are affected. The vulnerability was published on March 5, 2026, and assigned a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly associated with CAPEC-193 (PHP Remote File Inclusion). The root cause is insufficient validation or sanitization of user-supplied input that is passed directly to a PHP include() or require() statement within the Don Peppe theme, enabling an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting some precondition or constraint (such as specific server configuration or path traversal requirements) must be met (Feedly). No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation could allow an unauthenticated remote attacker to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files (e.g., wp-config.php containing database credentials), private keys, or other sensitive data. Under certain server configurations, LFI can be escalated to remote code execution by including files containing attacker-controlled PHP code (e.g., via log poisoning or uploaded files). The vulnerability carries high impacts to confidentiality, integrity, and availability, and could serve as a foothold for further compromise of the WordPress installation or underlying server (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was detected by Qualys (detection ID 531097) (Feedly).

No official patch has been confirmed in the available vulnerability data; users should check for an updated version of the Don Peppe theme beyond version 1.3 from Select-Themes or the WordPress theme repository (Feedly). As interim mitigations, administrators should implement strict input validation and sanitization for any file inclusion parameters, apply the principle of least privilege to restrict PHP file system access, and consider PHP configuration hardening (e.g., disabling allow_url_include, restricting open_basedir). Deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns can help detect and block exploitation attempts (Feedly).

The vulnerability was reported by Patchstack and included in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026 (Wordfence). Qualys also published detection coverage for this CVE in their April 2026 application security detections update (Qualys). No significant broader media coverage or notable researcher commentary has been identified beyond these routine security reporting channels.