CVE-2026-22370
Published: 20 February 2026
Summary
CVE-2026-22370 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents exploitation of the PHP Local File Inclusion by validating filename inputs used in include/require statements to block arbitrary local file execution.
Remediates the specific flaw in the Marveland WordPress theme by identifying, prioritizing, and correcting the improper filename control vulnerability in affected versions up to 1.3.0.
Enforces secure PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit arbitrary local file access even if application code is flawed.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in a public-facing WordPress theme enables unauthenticated remote exploitation of a public-facing application.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Marveland marveland allows PHP Local File Inclusion.This issue affects Marveland: from n/a through <= 1.3.0.
Deeper analysisAI
CVE-2026-22370 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, specifically a PHP Remote File Inclusion flaw that enables PHP Local File Inclusion, in the Marveland WordPress theme developed by axiomthemes. The issue affects all versions of Marveland up to and including 1.3.0. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.
Remote, unauthenticated attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to include and execute arbitrary local files on the server, potentially leading to high-impact confidentiality breaches, integrity modifications, and availability disruptions, such as unauthorized access to sensitive data or remote code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/marveland/vulnerability/wordpress-marveland-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve provides details on this WordPress theme vulnerability.
Details
- CWE(s)