CVE-2026-22420
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Horizon horizon allows PHP Local File Inclusion.This issue affects Horizon: from n/a through <= 1.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of untrusted inputs like filenames in PHP include/require statements to prevent local file inclusion attacks as in CVE-2026-22420.
Mandates timely patching and remediation of known flaws such as the PHP file inclusion vulnerability in the Horizon WordPress theme up to version 1.1.
Enforces secure PHP configuration settings like open_basedir restrictions or disabling dangerous functions to limit the impact of file inclusion vulnerabilities.
Security SummaryAI
CVE-2026-22420 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion in the AncoraThemes Horizon WordPress theme. The vulnerability affects Horizon versions from n/a through 1.1 inclusive, as documented with CWE-98 and published on 2026-03-05.
The vulnerability can be exploited by unauthenticated attackers (PR:N) over the network (AV:N) with high attack complexity (AC:H) and no user interaction required (UI:N). Successful exploitation results in high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.1 and potential for unauthorized file access or manipulation on the affected system.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/horizon/vulnerability/wordpress-horizon-theme-1-1-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-22420 is a Local File Inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application.