CVE-2026-22361
Published: 20 February 2026
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2026-22361 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the A-Mart WordPress theme developed by axiomthemes. The issue impacts all versions from n/a through 1.0.2 and is associated with CWE-98.
Unauthenticated remote attackers (AV:N/PR:N/UI:N) can exploit this vulnerability over the network, though it requires high attack complexity (AC:H). Successful exploitation can result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 8.1 and unchanged scope (S:U), potentially allowing attackers to include and execute arbitrary local files on the server.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/a-mart/vulnerability/wordpress-a-mart-theme-1-0-2-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in A-Mart theme version 1.0.2.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables T1190 (Exploit Public-Facing Application) for network-based unauthenticated exploitation and facilitates T1005 (Data from Local System) via local file disclosure.