PT-2026-23155 · Mikado Themes · Fiorello

Tran Nguyen Bao Khanh · Publicado 2026-03-05 · Atualizado 2026-03-08 · CVE-2026-22395

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mikado-Themes Fiorello versions prior to 1.1

Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. The affected component is the Fiorello theme.

Recommendations Update to Fiorello version 1.1 or later.

Correção

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

CVE-2026-22395

Produtos afetados

Fiorello

Referências · 3

• https://twitter.com/CVEnew/status/2030755387616493780 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Theme/fiorello/vulnerability/wordpress-fiorello-theme-1-0-local-file-inclusion-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22395 · Nota de Segurança