CVE-2026-22392
Published: 05 March 2026
Summary
CVE-2026-22392 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22392 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, referred to as PHP Remote File Inclusion, present in the Mikado-Themes Cortex WordPress theme. The flaw enables PHP Local File Inclusion and affects Cortex versions from n/a through 1.9. Published on 2026-03-05, it is associated with CWE-98 and carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network, requiring high attack complexity but no user interaction or privileges. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, such as unauthorized access to local files or potential code execution via inclusion of sensitive PHP files.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the Cortex WordPress theme at https://patchstack.com/database/Wordpress/Theme/cortex/vulnerability/wordpress-cortex-theme-1-5-local-file-inclusion-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9532
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Cortex cortex allows PHP Local File Inclusion.This issue affects Cortex: from n/a through <= 1.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables exploitation of a public-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates user-supplied filenames in PHP include/require statements to prevent local file inclusion attacks like this CVE.
Remediates the specific flaw in Mikado-Themes Cortex versions through 1.9 by identifying, patching, and testing updates.
Enforces secure configuration settings in PHP, such as open_basedir restrictions, to limit the scope of local file inclusion.