CVE-2026-22499
Published: 25 March 2026
Summary
CVE-2026-22499 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22499 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Elated-Themes Lella WordPress theme. This issue impacts all versions of Lella from n/a through 1.2 inclusive. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated attack complexity.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network, though high attack complexity is necessary. Successful exploitation allows attackers to perform local file inclusion, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized access to local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/lella/vulnerability/wordpress-lella-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve provides details on this vulnerability in the WordPress Lella theme version 1.2.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15506
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Lella lella allows PHP Local File Inclusion.This issue affects Lella: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-22499 is an unauthenticated remote LFI vulnerability in a public-facing WordPress theme (T1190: Exploit Public-Facing Application), enabling attackers to read arbitrary local files on the server (T1005: Data from Local System).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in the Lella theme's improper filename control for PHP include/require statements, preventing exploitation of CVE-2026-22499.
Validates filenames provided to PHP include/require functions to block malicious local file inclusion paths targeted by this vulnerability.
Enforces secure PHP configuration settings like open_basedir to restrict file access paths, limiting the impact of local file inclusion in the vulnerable theme.