CVE-2026-22374

CVE-2026-22374 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Zio Alberto WordPress theme developed by AncoraThemes. The flaw affects all versions of Zio Alberto up to and including 1.2.2, stemming from inadequate validation of filenames used in PHP include or require statements.

Attackers can exploit this vulnerability remotely over the network (AV:N) with no required privileges (PR:N) or user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with unchanged scope (S:U), resulting in a CVSS v3.1 base score of 8.1. This allows local file inclusion, potentially enabling attackers to read sensitive server files or, in some configurations, escalate to remote code execution.

The primary advisory from Patchstack details the vulnerability in the Zio Alberto theme version 1.2.2 and provides information on patches or mitigations available through their database. Security practitioners should consult https://patchstack.com/database/Wordpress/Theme/zioalberto/vulnerability/wordpress-zio-alberto-theme-1-2-2-local-file-inclusion-vulnerability?_s_id=cve for specific remediation steps, such as updating to a patched version if available.