CVE-2026-22374
Published: 20 February 2026
Summary
CVE-2026-22374 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22374 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Zio Alberto WordPress theme developed by AncoraThemes. The flaw affects all versions of Zio Alberto up to and including 1.2.2, stemming from inadequate validation of filenames used in PHP include or require statements.
Attackers can exploit this vulnerability remotely over the network (AV:N) with no required privileges (PR:N) or user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with unchanged scope (S:U), resulting in a CVSS v3.1 base score of 8.1. This allows local file inclusion, potentially enabling attackers to read sensitive server files or, in some configurations, escalate to remote code execution.
The primary advisory from Patchstack details the vulnerability in the Zio Alberto theme version 1.2.2 and provides information on patches or mitigations available through their database. Security practitioners should consult https://patchstack.com/database/Wordpress/Theme/zioalberto/vulnerability/wordpress-zio-alberto-theme-1-2-2-local-file-inclusion-vulnerability?_s_id=cve for specific remediation steps, such as updating to a patched version if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8385
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Zio Alberto zioalberto allows PHP Local File Inclusion.This issue affects Zio Alberto: from n/a through <= 1.2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP Remote/Local File Inclusion vulnerability in a WordPress theme allows unauthenticated remote exploitation of a public-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing local file inclusion by enforcing input sanitization.
Requires timely patching of the specific flaw in the Zio Alberto WordPress theme up to version 1.2.2 to eliminate the vulnerability.
Enforces secure PHP configuration settings like open_basedir and allow_url_include=Off to restrict unauthorized file access even if code validation is flawed.