CVE-2026-22441
Local File Inclusion Vulnerability in Zentrum
Publication date: 2026-03-05
Last updated on: 2026-03-10
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elated-themes | zentrum | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'CVE-2026-22441 is a Local File Inclusion (LFI) vulnerability affecting the WordPress Zentrum Theme up to version 1.0. Detection typically involves monitoring for attempts to include local files via HTTP requests targeting the vulnerable theme.'}, {'type': 'paragraph', 'content': 'While no specific detection commands are provided, common approaches include inspecting web server logs for suspicious requests containing file inclusion patterns such as "../" sequences or attempts to access sensitive files like /etc/passwd or configuration files.'}, {'type': 'paragraph', 'content': 'Network detection can be enhanced by using web application firewalls (WAFs) or intrusion detection systems (IDS) configured to detect LFI attack signatures.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
There is currently no official patch available for this vulnerability in the Zentrum theme.
Immediate mitigation involves applying the Patchstack mitigation rule designed to block attacks targeting this LFI flaw.
Users are strongly advised to implement this mitigation rule immediately to protect their websites from potential exploitation.
Additionally, monitoring and restricting access to sensitive files and ensuring proper input validation can help reduce risk until an official patch is released.
Can you explain this vulnerability to me?
CVE-2026-22441 is a Local File Inclusion (LFI) vulnerability in the WordPress Zentrum Theme versions up to and including 1.0. It allows unauthenticated attackers to include and display local files from the target website by exploiting improper control of filenames in PHP include/require statements.
This vulnerability falls under the OWASP Top 10 category A3: Injection and requires no privileges to exploit.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'Exploiting this vulnerability can lead to the exposure of sensitive information such as database credentials by allowing attackers to include and display local files from the website.'}, {'type': 'paragraph', 'content': "Depending on the website's configuration, this flaw could result in a complete database takeover."}, {'type': 'paragraph', 'content': 'The vulnerability has a high severity score of 8.1, indicating a strong likelihood of exploitation and a highly dangerous risk.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know