CVE-2026-22513: 
WordPress vulnerability analysis and mitigation

CVE-2026-22513 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Triompher WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Triompher theme through 1.1.0 and allows unauthenticated remote attackers to include and read arbitrary local files from the server. The vulnerability was published on March 25, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, ENISA EUVD).

The vulnerability stems from improper validation and sanitization of user-controlled input used in PHP include/require statements within the Triompher theme (CWE-98). An attacker can manipulate filename parameters passed to these PHP file inclusion functions to traverse the file system and include arbitrary local files. Exploitation requires no authentication, no user interaction, and no special privileges, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific parameter manipulation). No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows an unauthenticated attacker to read sensitive files from the WordPress server, including configuration files (e.g., wp-config.php) that may contain database credentials, secret keys, and other sensitive information. This exposure can lead to full system compromise, unauthorized database access, and potential lateral movement within the affected infrastructure. Confidentiality, integrity, and availability are all rated as High impact (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was disclosed and assigned by Patchstack (Feedly, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites using the Triompher theme (version ≤ 1.1.0) via passive fingerprinting tools such as WPScan, Shodan, or by inspecting HTTP response headers and page source for theme references.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or use fuzzing tools to identify parameters passed to PHP include/require statements that accept user-controlled input.
3. Craft LFI payload: Construct an HTTP request with a path traversal payload (e.g., ../../../../wp-config.php) in the vulnerable parameter to attempt local file inclusion.
4. Extract sensitive data: If successful, the server returns the contents of the targeted file (e.g., wp-config.php), exposing database credentials, authentication keys, and salts.
5. Escalate access: Use extracted credentials to access the WordPress database directly or authenticate to the WordPress admin panel, enabling further compromise or lateral movement (Feedly).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters.
• Logs: Web server access logs showing requests to Triompher theme PHP files with suspicious parameter values referencing system files (e.g., /etc/passwd, wp-config.php).
• Logs: HTTP 200 responses to requests containing path traversal patterns targeting theme endpoints, particularly from unfamiliar IP addresses.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or /etc/passwd that do not correspond to legitimate administrative activity.

Users should immediately upgrade the AncoraThemes Triompher WordPress theme to a version newer than 1.1.0, which contains the fix for this vulnerability. If an immediate upgrade is not possible, administrators should implement network-level controls (e.g., WAF rules) to block requests containing path traversal sequences targeting theme files, and restrict public access to theme PHP files where feasible. Monitoring server logs for suspicious file access attempts is also recommended as a compensating control (Feedly, Patchstack).