CVE-2026-22432
Published: 05 March 2026
Summary
CVE-2026-22432 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22432 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Woopy WordPress theme developed by AncoraThemes. The flaw affects all versions of Woopy from n/a through 1.2 inclusive. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant impacts across confidentiality, integrity, and availability.
Unauthenticated attackers with network access can exploit this vulnerability remotely, though it requires high attack complexity. No privileges or user interaction are needed. Successful exploitation allows arbitrary local file inclusion via manipulated PHP include/require statements, potentially enabling attackers to read sensitive files, execute arbitrary code if PHP files are included, or disrupt system availability.
The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Theme/woopy/vulnerability/wordpress-woopy-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion issue in Woopy theme version 1.2 and preceding releases. Security practitioners should update to a version beyond 1.2 where available, apply input validation on file inclusion parameters, and monitor for anomalous requests targeting theme endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9558
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Woopy woopy allows PHP Local File Inclusion.This issue affects Woopy: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme exploited via T1190 (Exploit Public-Facing Application), directly enabling unauthorized access to local files (T1005: Data from Local System) and file enumeration (T1083: File and Directory Discovery).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching of the Woopy theme vulnerability beyond version 1.2 to remediate the improper filename control in PHP include/require statements.
Directly addresses the CWE-98 flaw by enforcing validation of inputs to PHP include/require functions, preventing local file inclusion via manipulated filenames.
Facilitates detection of exploitation attempts through monitoring for anomalous requests targeting Woopy theme endpoints indicative of file inclusion attacks.