Cyber Posture

CVE-2026-22504

High

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion.This issue affects ProLingua: from n/a through <= 1.1.12.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely identification, reporting, and patching of the LFI flaw in ProLingua theme versions through 1.1.12.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by validating user-supplied filenames prior to use in PHP include/require statements to block arbitrary local file inclusion.

CM-6 Configuration Settings partial match
prevent

Enforces secure PHP configuration settings like open_basedir restrictions to limit the scope of local file access even if input validation fails.

Security SummaryAI

CVE-2026-22504 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and described as enabling PHP Local File Inclusion, in the ThemeREX ProLingua WordPress theme. It affects ProLingua versions from an unspecified starting point through 1.1.12. The issue was published on 2026-03-25 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely by unauthenticated attackers over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing attackers to include and execute arbitrary local files on the server.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/prolingua/vulnerability/wordpress-prolingua-theme-1-1-12-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of a public-facing WordPress application (T1190) via LFI, directly facilitating data collection from local system files such as configs or source code (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References