Cyber Posture

CVE-2026-22515

High

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates improper control of filenames in PHP include/require statements by enforcing input validation, preventing local file inclusion in the VegaDays theme.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the specific flaw in VegaDays theme versions <=1.2.0 through patching as advised by Patchstack.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection mechanisms like web application firewalls monitor and block network-based exploitation attempts targeting the file inclusion vulnerability.

Security SummaryAI

CVE-2026-22515 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the AncoraThemes VegaDays WordPress theme (also referred to as vegadays). It enables PHP Local File Inclusion and affects all versions of VegaDays from n/a through 1.2.0.

The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers (no privileges required) with high attack complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing attackers to read sensitive files, execute arbitrary code, modify data, or cause denial of service on the affected WordPress site.

Patchstack has published an advisory detailing the vulnerability in the VegaDays theme version 1.2.0, available at https://patchstack.com/database/Wordpress/Theme/vegadays/vulnerability/wordpress-vegadays-theme-1-2-0-local-file-inclusion-vulnerability?_s_id=cve, which provides information on the issue and likely mitigation steps such as updating to a patched version beyond 1.2.0.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote file inclusion vulnerability in a public-facing WordPress theme directly enables exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References