CVE-2026-22371
Published: 20 February 2026
Summary
CVE-2026-22371 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22371 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion. It affects the Gustavo WordPress theme developed by AncoraThemes, impacting all versions from n/a through 1.2.2.
The vulnerability carries a CVSS v3.1 base score of 8.1 (High), with an attack vector of network (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can exploit it to perform local file inclusion, potentially allowing them to read sensitive files, execute arbitrary code, modify data, or disrupt service on affected WordPress installations running the vulnerable theme.
Patchstack has documented this local file inclusion vulnerability specific to the Gustavo WordPress theme version 1.2.2 in their database.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8252
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Gustavo gustavo allows PHP Local File Inclusion.This issue affects Gustavo: from n/a through <= 1.2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress theme enables T1190 (exploit public-facing app), facilitates T1005 (data from local system via file access), and T1552.001 (credentials in files like wp-config.php).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the flaw in the Gustavo WordPress theme directly patches the PHP local file inclusion vulnerability, preventing exploitation across all affected versions.
Validating filename inputs used in PHP include/require statements in the vulnerable theme prevents attackers from supplying malicious paths for local file inclusion.
Restricting filename inputs to only approved values or patterns blocks unauthorized local file inclusion attempts in the Gustavo theme's PHP code.