CVE-2026-22515
Published: 25 March 2026
Summary
CVE-2026-22515 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22515 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the AncoraThemes VegaDays WordPress theme (also referred to as vegadays). It enables PHP Local File Inclusion and affects all versions of VegaDays from n/a through 1.2.0.
The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers (no privileges required) with high attack complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing attackers to read sensitive files, execute arbitrary code, modify data, or cause denial of service on the affected WordPress site.
Patchstack has published an advisory detailing the vulnerability in the VegaDays theme version 1.2.0, available at https://patchstack.com/database/Wordpress/Theme/vegadays/vulnerability/wordpress-vegadays-theme-1-2-0-local-file-inclusion-vulnerability?_s_id=cve, which provides information on the issue and likely mitigation steps such as updating to a patched version beyond 1.2.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15530
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote file inclusion vulnerability in a public-facing WordPress theme directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates improper control of filenames in PHP include/require statements by enforcing input validation, preventing local file inclusion in the VegaDays theme.
Requires timely remediation of the specific flaw in VegaDays theme versions <=1.2.0 through patching as advised by Patchstack.
Boundary protection mechanisms like web application firewalls monitor and block network-based exploitation attempts targeting the file inclusion vulnerability.