CVE-2026-22376
Published: 20 February 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Parkivia parkivia allows PHP Local File Inclusion.This issue affects Parkivia: from n/a through <= 1.1.9.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of user-supplied filenames in PHP include/require statements to block local file inclusion exploits.
Mandates timely identification, reporting, and patching of the specific flaw in Parkivia theme versions up to 1.1.9.
Establishes secure PHP configuration settings like disabling allow_url_include and enforcing open_basedir to restrict unauthorized local file access.
Security SummaryAI
CVE-2026-22376 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, in the AncoraThemes Parkivia WordPress theme. This flaw enables PHP Local File Inclusion and affects all versions of Parkivia up to and including 1.1.9. The vulnerability stems from inadequate validation of filenames used in PHP include or require statements, allowing malicious input to reference local files on the server.
Remote attackers can exploit this vulnerability over the network without authentication or user interaction, though it requires high attack complexity. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, as reflected in its CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers could potentially read sensitive local files, execute arbitrary code, modify data, or cause denial of service on the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/parkivia/vulnerability/wordpress-parkivia-theme-1-1-9-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion issue in Parkivia theme version 1.1.9 and recommends updating to a patched version where available, alongside general best practices like input sanitization for file inclusion operations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-22376 is a remote file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for unauthenticated remote code execution or file inclusion.