CVE-2026-22503: 
WordPress vulnerability analysis and mitigation

CVE-2026-22503 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Nelson WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Nelson theme through 1.2.0 and allows unauthenticated remote attackers to include arbitrary local files on the server. The vulnerability was published on March 25, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Nelson theme (CWE-98). An attacker can manipulate a filename parameter passed to these PHP file inclusion functions to reference arbitrary files on the server's filesystem, enabling Local File Inclusion (LFI). Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting specific conditions or non-default configurations may need to be met. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows attackers to read sensitive files from the server (e.g., WordPress configuration files containing database credentials) and potentially execute arbitrary code if combined with file upload capabilities or log poisoning techniques. The vulnerability has a HIGH impact on confidentiality, integrity, and availability of affected systems, with no privilege escalation required. Exposure of credentials via files such as wp-config.php could enable further lateral movement within the hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The High attack complexity rating further reduces the immediate risk of widespread exploitation (Feedly).

Users should immediately upgrade the ThemeREX Nelson WordPress theme to a version higher than 1.2.0, which contains the patch for this vulnerability. As interim measures, administrators should implement network-level controls to restrict access to the affected WordPress installation and deploy a Web Application Firewall (WAF) configured to detect and block LFI attack patterns targeting PHP include/require statements. Server logs should be monitored for suspicious file path traversal patterns in HTTP requests (Feedly, Patchstack).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, and tracked by VulDB. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings (Feedly).