CVE-2026-22476: 
WordPress vulnerability analysis and mitigation

CVE-2026-22476 is a PHP Local File Inclusion (LFI) vulnerability in the Elated-Themes Etchy WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Etchy theme up to and including version 1.0. The vulnerability was published on March 5, 2026, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Etchy theme (CWE-98). An attacker can manipulate a filename parameter passed to these PHP file inclusion functions to reference arbitrary local files on the server. The attack vector is network-based, requires no authentication or user interaction, but has high attack complexity, suggesting some precondition or bypass technique is needed to successfully exploit it. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation of this LFI vulnerability can result in high impacts to confidentiality, integrity, and availability. An unauthenticated remote attacker could read sensitive server files (e.g., WordPress wp-config.php containing database credentials), modify files, or potentially achieve remote code execution if combined with file upload or log poisoning techniques. This could lead to full site compromise, data exfiltration, and service disruption (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity rating suggests exploitation is non-trivial without specific preconditions (Feedly).

No patched version of the Etchy theme has been confirmed available at this time. Administrators should immediately audit all installations of Etchy theme version 1.0 and earlier for signs of exploitation. As an interim measure, consider disabling or removing the affected theme until a patch is released. Deploy Web Application Firewall (WAF) rules to detect and block PHP Local File Inclusion attempts, apply the principle of least privilege to web server file system permissions, and monitor server logs for suspicious file inclusion patterns (Feedly, Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, indicating it was tracked by the broader WordPress security community. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability disclosure channels (Wordfence).