PT-2026-50284 · Themeum+1 · Right Way

Tran Nguyen Bao Khanh · CVE-2026-22330 · Published 2026-01-12 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Right Way versions prior to 4.1

Description The Right Way theme for WordPress allows unauthenticated attackers to perform Local File Inclusion, which is a flaw that lets an attacker include files from the local server. This can lead to the execution of arbitrary PHP code, bypassing access controls, and the theft of sensitive data, especially if the attacker can upload files to the server.

Recommendations Update to a version newer than 4.0.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-22330

Affected Products

Right Way

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-22330 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e5a7741-d8be-400e-ac00-138034580d6e?source=api-prod · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22330 · Note
• https://patchstack.com/database/wordpress/theme/rightway/vulnerability/wordpress-right-way-theme-4-0-local-file-inclusion-vulnerability?_s_id=cve · Note