PT-2026-26597 · Themerex · Melania

Tran Nguyen Bao Khanh · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-22324

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThemeREX Melania versions through 2.5.0

Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. The issue affects the software's handling of file inclusion, potentially allowing an attacker to include arbitrary local files.

Recommendations Update ThemeREX Melania to a version later than 2.5.0.

Correção

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

CVE-2026-22324

Produtos afetados

Melania

Referências · 6

• https://twitter.com/TheHackerWire/status/2035114175387902346 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035626994616922469 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Theme/melania/vulnerability/wordpress-melania-theme-2-5-0-local-file-inclusion-vulnerability?_s_id=cve · Nota
• https://patchstack.com/database/wordpress/theme/melania/vulnerability/wordpress-melania-theme-2-5-0-local-file-inclusion-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22324 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034997718377017603 · Publicação no Twitter