CVE-2026-22516: 
WordPress vulnerability analysis and mitigation

CVE-2026-22516 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Wizor's (wizors-investments) WordPress theme, caused by improper control of filenames in PHP include/require statements. It affects all versions of the Wizor's theme through 2.12. The vulnerability was published on March 25, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction (Feedly, Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), where user-supplied input is passed unsanitized to a PHP include() or require() statement within the Wizor's theme. This allows an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no privileges and no user interaction, but is rated High complexity (AC:H), suggesting some precondition such as specific server configuration or path traversal constraints must be met. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) (Feedly).

Successful exploitation allows a remote, unauthenticated attacker to read sensitive files on the server (e.g., configuration files, credentials) and potentially execute arbitrary PHP code, fully compromising the confidentiality, integrity, and availability of the affected WordPress installation. This could expose database credentials, WordPress secret keys, and other sensitive data stored on the server, and may enable further lateral movement within the hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation for CVE-2026-22516. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites using the AncoraThemes Wizor's theme (version ≤ 2.12) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the endpoint or parameter that is passed to a PHP include()/require() statement without proper sanitization.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../etc/passwd or ../../../../wp-config.php) in the vulnerable filename parameter.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site, targeting the vulnerable theme file or endpoint.
5. Retrieve sensitive data: If successful, the server response will contain the contents of the targeted local file (e.g., database credentials from wp-config.php), which can be used for further compromise (Feedly).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: Web server access logs showing requests to Wizor's theme PHP files with suspicious filename parameters referencing system files (e.g., /etc/passwd, wp-config.php); HTTP 200 responses to such requests with unexpectedly large or structured response bodies.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or PHP session files coinciding with suspicious web requests.
• Process: PHP processes reading files outside the WordPress web root directory, observable via system audit logs (e.g., auditd on Linux).

Update the AncoraThemes Wizor's theme to a version newer than 2.12, which contains the patch for this vulnerability. As a temporary workaround, consider disabling the theme if an update is not immediately available, or implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences targeting theme files. Additionally, ensure allow_url_include is disabled in php.ini to reduce the risk of remote file inclusion, and restrict file system permissions to limit what the web server process can read (Feedly, Patchstack).