CVE-2026-22367

WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability

View on CVE.org
Published Feb 20, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Coworking coworking allows PHP Local File Inclusion.This issue affects Coworking: from n/a through <= 1.6.1.

Analysis

AI-generated

Technical impact

The vulnerability arises from improper control of filename for include/require statements in PHP, allowing an attacker to request arbitrary local files for inclusion. This weakness can lead to sensitive file disclosure or, if attacker‑controlled files are executed, remote code execution. The vulnerability is classified as CWE‑98.

Affected Systems

This flaw affects AncoraThemes Coworking theme versions n/a through 1.6.1, used in WordPress installations that have selected this theme.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the attack vector is likely through inputs that control the include path; an attacker who can influence such parameters, possibly via theme options or URL manipulation, may trigger the inclusion of sensitive files.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Coworking theme to a version newer than 1.6.1 or remove the theme if no patch is available.
  • If an update is not possible, disable or delete the theme to prevent its execution.
  • Apply file permission restrictions so that the web server process cannot read sensitive configuration files and constrain the PHP include path to a whitelist.

Generated by OpenCVE AI on April 16, 2026 at 06:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Ancorathemes
Ancorathemes coworking
Wordpress
Wordpress wordpress
Vendors & Products Ancorathemes
Ancorathemes coworking
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Coworking coworking allows PHP Local File Inclusion.This issue affects Coworking: from n/a through <= 1.6.1.
Title WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:50 PM
Reserved
Jan 7, 2026, 12:21 PM

View source JSON

Updated
Feb 24, 2026, 8:31 PM

JSON

Status
Deferred
Published
Feb 20, 2026, 4:22 PM
Modified
Jun 17, 2026, 10:19 AM

View source JSON

No data.

Updated
Apr 16, 2026, 6:30 AM

JSON