PT-2026-26597 · Themerex · Melania

Tran Nguyen Bao Khanh · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-22324

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThemeREX Melania versions through 2.5.0

Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. The issue affects the software's handling of file inclusion, potentially allowing an attacker to include arbitrary local files.

Recommendations Update ThemeREX Melania to a version later than 2.5.0.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-22324

Affected Products

Melania

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22324 · Security Note
• https://twitter.com/TheHackerWire/status/2035114175387902346 · Twitter Post
• https://twitter.com/CVEnew/status/2035626994616922469 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/melania/vulnerability/wordpress-melania-theme-2-5-0-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/theme/melania/vulnerability/wordpress-melania-theme-2-5-0-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2034997718377017603 · Twitter Post