CVE-2026-22387
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Aviana aviana allows PHP Local File Inclusion.This issue affects Aviana: from n/a through <= 2.1.
Mitigating Controls (NIST 800-53 r5)AI
Remediating flaws in vulnerable WordPress themes like Aviana directly eliminates the LFI vulnerability in PHP include/require statements.
Validating filenames and paths used in dynamic PHP includes prevents path traversal and unauthorized local file inclusion exploited by this CVE.
Secure configuration settings for PHP, such as open_basedir restrictions, limit the scope of file access and mitigate LFI attempts even if input validation fails.
Security SummaryAI
CVE-2026-22387 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Mikado-Themes Aviana WordPress theme. This issue affects Aviana versions from n/a through 2.1, as documented with CWE-98. The vulnerability was published on 2026-03-05.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers (PR:N) with no user interaction required (UI:N), though high attack complexity (AC:H) is needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, allowing attackers to perform local file inclusion, potentially leading to unauthorized access to sensitive files or code execution within the theme's context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/aviana/vulnerability/wordpress-aviana-theme-2-1-local-file-inclusion-vulnerability?_s_id=cve provides details on the Local File Inclusion vulnerability specific to Aviana theme version 2.1.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing WordPress theme vulnerability via PHP Local File Inclusion, enabling arbitrary file reads or code execution, directly maps to T1190: Exploit Public-Facing Application.