CVE-2026-22495: 
WordPress vulnerability analysis and mitigation

CVE-2026-22495 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Greenville WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Greenville theme through 1.3.2 and was published on March 25, 2026, with the vulnerability reported by Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Greenville theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server. The attack vector is network-based, requires no authentication or user interaction, but does carry high attack complexity, suggesting some precondition or non-trivial exploitation step is required. An attacker can craft a malicious request that passes a controlled filename to a vulnerable include/require call, causing the PHP interpreter to load and execute unintended local files (Feedly).

Successful exploitation can result in unauthorized disclosure of sensitive server files (e.g., configuration files containing credentials), potential arbitrary code execution if writable files or upload directories can be leveraged, and full compromise of the affected WordPress installation. The vulnerability impacts confidentiality, integrity, and availability at a high level, and could serve as a stepping stone for lateral movement within a hosting environment (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was disclosed by Patchstack (Feedly, Patchstack).

No official patch has been confirmed for the Greenville theme beyond version 1.3.2 at the time of disclosure. Administrators should immediately audit all installations of the AncoraThemes Greenville theme and update to any version released beyond 1.3.2 if available, or consider replacing the theme. In the interim, implement Web Application Firewall (WAF) rules to detect and block file inclusion attempts, enforce strict file system permissions to limit access to sensitive files, and monitor server logs for suspicious file path parameters in HTTP requests (Feedly).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, and was catalogued by VulDB shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified (Feedly).