{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22509", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-07T13:44:36.068Z", "datePublished": "2026-03-25T16:14:26.367Z", "dateUpdated": "2026-03-25T16:14:26.367Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://themeforest.net", "defaultStatus": "unaffected", "packageName": "gioia", "product": "Gioia", "vendor": "Elated-Themes", "versions": [{"lessThanOrEqual": "<= 1.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:09.629Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.<p>This issue affects Gioia: from n/a through <= 1.4.</p>"}], "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.This issue affects Gioia: from n/a through <= 1.4."}], "impacts": [{"capecId": "CAPEC-252", "descriptions": [{"lang": "en", "value": "PHP Local File Inclusion"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-98", "description": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:26.367Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Theme/gioia/vulnerability/wordpress-gioia-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve"}], "title": "WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.This issue affects Gioia: from n/a through <= 1.4."}], "id": "CVE-2026-22509", "lastModified": "2026-03-25T17:16:33.143", "metrics": {}, "published": "2026-03-25T17:16:33.143", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Theme/gioia/vulnerability/wordpress-gioia-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-25T19:54:02.559989+00:00", "value": {"mitigation_remediation": ["Upgrade the Gioia theme to a version newer than 1.4.", "If upgrading is not immediately possible, keep the theme disabled or remove any PHP functionality that processes user\u2011supplied file paths.", "Adjust file permissions on the server so that the web server cannot read sensitive files that should not be disclosed.", "Monitor web server logs for unexpected file access attempts that could indicate exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Local File Inclusion"}, "threat_synthesis": {"affected_systems": "WordPress installations that are using the Gioia theme version 1.4 or earlier are affected. The vulnerability is present in any deployment where the theme\u2019s PHP code processes user\u2011supplied paths without sanitization. Exact vendor-to-product mapping is Elated\u2011Themes Gioia theme.", "description_and_impact": "The Elated\u2011Themes Gioia WordPress theme contains a flaw in its handling of include/require statements, allowing an attacker to specify an arbitrary filename that the PHP runtime will include. This improper validation leads to a local file inclusion vulnerability, meaning the attacker can read any file the web server\u2019s process can access, such as configuration files, WordPress core files, or other sensitive data. The weakness is classified as CWE\u201198, Improper Control of Filename for Include/Require Statement.", "risk_and_exploitability": "No CVSS, EPSS, or KEV metrics are published for this issue, indicating that exploitation data and severity scoring are unavailable. It is likely that the attack vector involves a crafted HTTP request that supplies a malicious file path to the theme, which the web server then includes. Exploitation requires the attacker to control the input and for the server filesystem to grant read access to the targeted files; there is no evidence that this flaw leads to arbitrary code execution. As such, the risk is moderate, mainly exposing sensitive local files rather than full system compromise."}}}}, "created": "2026-03-25T21:35:11.288425+00:00", "updated": "2026-03-25T21:35:11.288452+00:00", "vendors": []}