Cyber Posture

CVE-2026-22432

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Woopy woopy allows PHP Local File Inclusion.This issue affects Woopy: from n/a through <= 1.2.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Requires timely patching of the Woopy theme vulnerability beyond version 1.2 to remediate the improper filename control in PHP include/require statements.

SI-10 Information Input Validation good match
prevent

Directly addresses the CWE-98 flaw by enforcing validation of inputs to PHP include/require functions, preventing local file inclusion via manipulated filenames.

SI-4 System Monitoring good match
detect

Facilitates detection of exploitation attempts through monitoring for anomalous requests targeting Woopy theme endpoints indicative of file inclusion attacks.

Security SummaryAI

CVE-2026-22432 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Woopy WordPress theme developed by AncoraThemes. The flaw affects all versions of Woopy from n/a through 1.2 inclusive. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant impacts across confidentiality, integrity, and availability.

Unauthenticated attackers with network access can exploit this vulnerability remotely, though it requires high attack complexity. No privileges or user interaction are needed. Successful exploitation allows arbitrary local file inclusion via manipulated PHP include/require statements, potentially enabling attackers to read sensitive files, execute arbitrary code if PHP files are included, or disrupt system availability.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Theme/woopy/vulnerability/wordpress-woopy-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion issue in Woopy theme version 1.2 and preceding releases. Security practitioners should update to a version beyond 1.2 where available, apply input validation on file inclusion parameters, and monitor for anomalous requests targeting theme endpoints.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme exploited via T1190 (Exploit Public-Facing Application), directly enabling unauthorized access to local files (T1005: Data from Local System) and file enumeration (T1083: File and Directory Discovery).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References