CVE-2026-22395
Published: 05 March 2026
Summary
CVE-2026-22395 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22395 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Fiorello WordPress theme developed by Mikado-Themes. The issue affects Fiorello versions from n/a through 1.0 inclusive, as documented with CWE-98. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.
The vulnerability can be exploited by unauthenticated attackers over the network, requiring no privileges or user interaction but high attack complexity. Successful exploitation allows attackers to achieve high confidentiality, integrity, and availability impacts through local file inclusion, potentially enabling unauthorized file access or execution depending on server configuration.
Mitigation details are available in advisories such as the Patchstack database entry for the WordPress Fiorello theme vulnerability: https://patchstack.com/database/Wordpress/Theme/fiorello/vulnerability/wordpress-fiorello-theme-1-0-local-file-inclusion-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9534
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Fiorello fiorello allows PHP Local File Inclusion.This issue affects Fiorello: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables exploitation of a public-facing application (T1190) for reading sensitive local files or potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identification, reporting, and remediation of system flaws, directly addressing the need to patch the PHP LFI vulnerability in the Fiorello WordPress theme.
SI-10 enforces validation of information inputs, preventing exploitation of improper filename controls in PHP include/require statements as seen in this CVE.
SC-7 provides boundary protection via web application firewalls or proxies to block network-based LFI attack payloads targeting this unauthenticated vulnerability.