CVE-2026-22437
Local File Inclusion in AncoraThemes Playa
Publication date: 2026-03-05
Last updated on: 2026-03-10
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ancorathemes | playa | to 1.3.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for CVE-2026-22437, immediate mitigation involves applying the Patchstack mitigation rule that blocks attacks exploiting this Local File Inclusion vulnerability.
This mitigation provides immediate protection until an official patch can be developed, tested, and safely applied.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts including the exposure of sensitive information like database credentials.'}, {'type': 'paragraph', 'content': "Depending on the website's configuration, exploitation could lead to a complete database takeover."}, {'type': 'paragraph', 'content': 'Because the vulnerability allows unauthenticated attackers to include local files, it poses a significant security risk to affected websites.'}, {'type': 'paragraph', 'content': 'The vulnerability has a high severity level with a CVSS score of 8.1.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2026-22437 is a Local File Inclusion (LFI) vulnerability found in the WordPress Playa Theme versions up to and including 1.3.9.
This vulnerability allows unauthenticated attackers to include local files from the target website by exploiting improper control of filename for include/require statements in the PHP program.
Exploiting this flaw can expose sensitive information such as database credentials.
The issue is classified under the OWASP Top 10 category A3: Injection.