PT-2026-27837 · Ancorathemes · Wizor'S Investments

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-22516

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AncoraThemes Wizor's wizors-investments versions through 2.12

Description The software contains a flaw related to improper control of filename handling for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. The issue impacts the software’s ability to securely handle file inclusion operations.

Recommendations Versions prior to or equal to 2.12 should be updated.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-22516

Affected Products

Wizor'S Investments

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-22516 · Security Note
• https://twitter.com/CVEnew/status/2038618116507275535 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/wizors-investments/vulnerability/wordpress-wizor-s-theme-2-12-local-file-inclusion-vulnerability?_s_id=cve · Note