CVE-2026-22387
Published: 05 March 2026
Summary
CVE-2026-22387 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22387 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Mikado-Themes Aviana WordPress theme. This issue affects Aviana versions from n/a through 2.1, as documented with CWE-98. The vulnerability was published on 2026-03-05.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers (PR:N) with no user interaction required (UI:N), though high attack complexity (AC:H) is needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, allowing attackers to perform local file inclusion, potentially leading to unauthorized access to sensitive files or code execution within the theme's context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/aviana/vulnerability/wordpress-aviana-theme-2-1-local-file-inclusion-vulnerability?_s_id=cve provides details on the Local File Inclusion vulnerability specific to Aviana theme version 2.1.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9529
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Aviana aviana allows PHP Local File Inclusion.This issue affects Aviana: from n/a through <= 2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing WordPress theme vulnerability via PHP Local File Inclusion, enabling arbitrary file reads or code execution, directly maps to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating flaws in vulnerable WordPress themes like Aviana directly eliminates the LFI vulnerability in PHP include/require statements.
Validating filenames and paths used in dynamic PHP includes prevents path traversal and unauthorized local file inclusion exploited by this CVE.
Secure configuration settings for PHP, such as open_basedir restrictions, limit the scope of file access and mitigate LFI attempts even if input validation fails.