Cyber Posture

CVE-2026-22370

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Marveland marveland allows PHP Local File Inclusion.This issue affects Marveland: from n/a through <= 1.3.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents exploitation of the PHP Local File Inclusion by validating filename inputs used in include/require statements to block arbitrary local file execution.

SI-2 Flaw Remediation good match
prevent

Remediates the specific flaw in the Marveland WordPress theme by identifying, prioritizing, and correcting the improper filename control vulnerability in affected versions up to 1.3.0.

CM-6 Configuration Settings good match
prevent

Enforces secure PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit arbitrary local file access even if application code is flawed.

Security SummaryAI

CVE-2026-22370 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, specifically a PHP Remote File Inclusion flaw that enables PHP Local File Inclusion, in the Marveland WordPress theme developed by axiomthemes. The issue affects all versions of Marveland up to and including 1.3.0. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.

Remote, unauthenticated attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to include and execute arbitrary local files on the server, potentially leading to high-impact confidentiality breaches, integrity modifications, and availability disruptions, such as unauthorized access to sensitive data or remote code execution.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/marveland/vulnerability/wordpress-marveland-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve provides details on this WordPress theme vulnerability.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

LFI vulnerability in a public-facing WordPress theme enables unauthenticated remote exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References