CVE-2026-24531
Published: 23 January 2026
Summary
CVE-2026-24531 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24531 is an Improper Control of Filename for Include/Require Statement vulnerability (CWE-98), classified as a PHP Local File Inclusion (LFI) issue, in the Prowess WordPress theme by Select-Themes. The flaw affects Prowess versions from n/a through 2.3 inclusive. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant impact despite elevated complexity.
Exploitation requires low privileges (PR:L), such as an authenticated low-level user, and can be performed remotely over the network (AV:N) with no user interaction (UI:N), though high attack complexity (AC:H) is needed. Successful attacks yield high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling attackers to include arbitrary local files, which could result in sensitive data exposure, file manipulation, or arbitrary code execution within the context of the vulnerable theme.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/prowess/vulnerability/wordpress-prowess-theme-2-3-local-file-inclusion-vulnerability?_s_id=cve) documents this vulnerability in the Prowess theme version 2.3 and provides relevant details for WordPress administrators. Practitioners should consult it for specific mitigation recommendations, such as theme updates or configuration hardening.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4401
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress theme directly enables remote exploitation of web app for code execution or file access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching and updating of the vulnerable Prowess WordPress theme to versions beyond 2.3.
Prevents LFI exploitation by enforcing validation of user-supplied filenames in PHP include/require statements against allowed values.
Mitigates LFI impact through secure PHP configuration settings like open_basedir restrictions or disabling dangerous functions such as include/require.