CVE-2026-22389
Published: 05 March 2026
Summary
CVE-2026-22389 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the specific PHP Local File Inclusion flaw in the Mikado-Themes Cocco WordPress theme by identifying, prioritizing, and applying patches or updates.
Validates user-supplied filenames in PHP include/require statements to block path traversal and unauthorized local file access exploited by this CVE.
Monitors and scans for vulnerabilities like CVE-2026-22389 in WordPress themes, enabling detection of the presence of the affected Cocco versions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WordPress theme vulnerability enables remote exploitation (T1190). LFI facilitates reading sensitive local files (T1005) and arbitrary PHP code execution (T1059).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Cocco cocco allows PHP Local File Inclusion.This issue affects Cocco: from n/a through <= 2.0.
Deeper analysisAI
CVE-2026-22389 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Mikado-Themes Cocco WordPress theme in versions from n/a through 2.0. Published on 2026-03-05, it is associated with CWE-98 and carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network, requiring high attack complexity but no user interaction or privileges. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling arbitrary file inclusion and execution of local files on the target server.
Patchstack has documented the vulnerability, specifically noting a Local File Inclusion issue in Cocco theme version 1.5.1, with details available at https://patchstack.com/database/Wordpress/Theme/cocco/vulnerability/wordpress-cocco-theme-1-5-1-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)