CVE-2026-22381
Published: 20 February 2026
Summary
CVE-2026-22381 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22381 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and described as enabling PHP Local File Inclusion, in the PawFriends - Pet Shop and Veterinary WordPress Theme developed by Mikado-Themes. The issue affects all versions of the theme from unknown initial release through 1.3 inclusive. It carries a CVSS v3.1 base score of 8.1 (High), reflecting network accessibility, high attack complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network. Exploitation requires high complexity but no privileges or user interaction, potentially allowing attackers to include and execute local files on the server, leading to unauthorized access, data disclosure, modification, or denial of service consistent with the high CVSS impacts.
The Patchstack advisory provides details on this vulnerability in PawFriends theme version 1.3 and related mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8259
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows PHP Local File Inclusion.This issue affects PawFriends - Pet Shop and Veterinary WordPress…
more
Theme: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme enables exploitation of public-facing application (T1190) for arbitrary local file inclusion, facilitating data collection from local system (T1005) and disclosure of unsecured credentials in files like wp-config.php (T1552.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific PHP Local File Inclusion flaw in the PawFriends WordPress theme by identifying, patching, and updating vulnerable versions through 1.3.
Validates user-supplied filenames for PHP include/require statements to block path traversal and unauthorized local file access exploited in this CVE.
Restricts inputs to PHP file inclusion functions to whitelisted safe filenames or paths, preventing attackers from specifying arbitrary local files.