Cyber Posture

CVE-2026-22395

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fiorello fiorello allows PHP Local File Inclusion.This issue affects Fiorello: from n/a through <= 1.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires identification, reporting, and remediation of system flaws, directly addressing the need to patch the PHP LFI vulnerability in the Fiorello WordPress theme.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation of information inputs, preventing exploitation of improper filename controls in PHP include/require statements as seen in this CVE.

SC-7 Boundary Protection partial match
preventdetect

SC-7 provides boundary protection via web application firewalls or proxies to block network-based LFI attack payloads targeting this unauthenticated vulnerability.

Security SummaryAI

CVE-2026-22395 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Fiorello WordPress theme developed by Mikado-Themes. The issue affects Fiorello versions from n/a through 1.0 inclusive, as documented with CWE-98. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.

The vulnerability can be exploited by unauthenticated attackers over the network, requiring no privileges or user interaction but high attack complexity. Successful exploitation allows attackers to achieve high confidentiality, integrity, and availability impacts through local file inclusion, potentially enabling unauthorized file access or execution depending on server configuration.

Mitigation details are available in advisories such as the Patchstack database entry for the WordPress Fiorello theme vulnerability: https://patchstack.com/database/Wordpress/Theme/fiorello/vulnerability/wordpress-fiorello-theme-1-0-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme directly enables exploitation of a public-facing application (T1190) for reading sensitive local files or potential RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References