Cyber Posture

CVE-2026-22477

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Felizia felizia allows PHP Local File Inclusion.This issue affects Felizia: from n/a through <= 1.3.4.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and correction of flaws such as the PHP file inclusion vulnerability in the Felizia WordPress theme.

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs like filenames in PHP include/require statements to prevent local file inclusion attacks.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

RA-5 enables vulnerability scanning to detect PHP remote/local file inclusion flaws in deployed WordPress themes like Felizia.

Security SummaryAI

CVE-2026-22477 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the Felizia WordPress theme by AncoraThemes. The vulnerability impacts all versions of Felizia from n/a through 1.3.4. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated attack complexity.

Remote attackers with network access can exploit this vulnerability without authentication or user interaction, though it requires high attack complexity. Successful exploitation allows attackers to perform local file inclusion, potentially leading to high impacts on confidentiality, integrity, and availability, such as unauthorized access to sensitive files or system compromise on the affected WordPress site.

The Patchstack advisory provides details on this vulnerability in the Felizia WordPress theme, available at https://patchstack.com/database/Wordpress/Theme/felizia/vulnerability/wordpress-felizia-theme-1-3-4-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, enabling unauthenticated remote attackers to include and execute local PHP files, directly mapping to exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References