CVE-2026-22376

High

Published: 20 February 2026

Published

20 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0042 33.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-22376 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22376 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, in the AncoraThemes Parkivia WordPress theme. This flaw enables PHP Local File Inclusion and affects all versions of Parkivia up to and including 1.1.9. The vulnerability stems from inadequate validation of filenames used in PHP include or require statements, allowing malicious input to reference local files on the server.

Remote attackers can exploit this vulnerability over the network without authentication or user interaction, though it requires high attack complexity. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, as reflected in its CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers could potentially read sensitive local files, execute arbitrary code, modify data, or cause denial of service on the affected WordPress site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/parkivia/vulnerability/wordpress-parkivia-theme-1-1-9-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion issue in Parkivia theme version 1.1.9 and recommends updating to a patched version where available, alongside general best practices like input sanitization for file inclusion operations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-8384

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Parkivia parkivia allows PHP Local File Inclusion.This issue affects Parkivia: from n/a through <= 1.1.9.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-22376 is a remote file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for unauthenticated remote code execution or file inclusion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0