CVE-2026-22452: 
WordPress vulnerability analysis and mitigation

CVE-2026-22452 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Hoverex WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Hoverex theme up to and including 1.5.10, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 4, 2025, and published by Patchstack on March 3, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and control of filenames used in PHP include/require statements within the Hoverex theme (CWE-98), enabling PHP Local File Inclusion. An unauthenticated attacker can send a crafted network request that manipulates a filename parameter to include arbitrary local files on the server. Exploitation requires high attack complexity (e.g., specific server configuration or chaining with another vulnerability), but no authentication or user interaction is needed. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to include and render arbitrary local files from the web server, potentially exposing sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, unauthorized access to site content, or execution of arbitrary PHP code if combined with a file upload or log poisoning technique. The vulnerability affects confidentiality, integrity, and availability — all rated High in the CVSS scoring (Patchstack).

There is no known public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Hoverex theme (version ≤ 1.5.10) via tools like WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/hoverex/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP code or observed HTTP requests to locate the parameter that controls a filename passed to a PHP include/require statement.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's response for the contents of the included file, which may expose database credentials, API keys, or other configuration secrets.
5. Escalate (optional): If log poisoning or a writable upload directory is available, inject PHP code into a log file and include it via the LFI to achieve remote code execution (Patchstack).

• Network: HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters targeting the Hoverex theme endpoints; unusual GET/POST requests to theme PHP files with unexpected filename parameters.
• Logs: WordPress or web server access logs showing requests with traversal patterns or references to sensitive files like wp-config.php, /etc/passwd, or PHP log files; repeated 200 responses to unusual theme file requests.
• File System: Unexpected PHP files or web shells in the Hoverex theme directory (/wp-content/themes/hoverex/); modified theme files with injected PHP code.
• Process: Unusual PHP child processes spawned by the web server (e.g., curl, wget, bash) that may indicate successful code execution via log poisoning chained with LFI (Patchstack).

No official patch from ThemeREX is currently available for the Hoverex theme. Site owners should update to a version newer than 1.5.10 if and when a patched release becomes available, or consider replacing the theme. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal and file inclusion patterns is recommended. Restricting PHP file execution in theme directories and monitoring access logs for traversal attempts are also advised (Patchstack).

Wordfence included CVE-2026-22452 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of theme vulnerabilities (Wordfence). Patchstack, which coordinated disclosure, emphasized the high-severity nature of the flaw and its potential for use in mass-exploit campaigns against WordPress sites (Patchstack). No significant broader media coverage or notable researcher commentary beyond these sources has been identified.