CVE-2026-22365: Soleng Theme PHP File Inclusion Flaw

CVE-2026-22365 Overview

CVE-2026-22365 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Soleng WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary PHP files from the server. The vulnerability affects all Soleng theme versions up to and including 1.0.5. Successful exploitation can lead to source code disclosure, configuration file exposure, and in some configurations remote code execution through chained log poisoning or session file inclusion techniques.

Critical Impact
Unauthenticated network-based exploitation can disclose sensitive WordPress files such as wp-config.php and potentially achieve arbitrary code execution on the underlying host.

Affected Products

axiomthemes Soleng WordPress theme versions n/a through <= 1.0.5
WordPress installations using the vulnerable Soleng theme
Any hosting environment serving the affected Soleng theme files

Discovery Timeline

2026-02-20 - CVE-2026-22365 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-22365

Vulnerability Analysis

The Soleng theme passes user-controlled input into a PHP file inclusion statement without enforcing an allowlist or path canonicalization. PHP's include, include_once, require, and require_once functions execute any PHP code found in the referenced file. When attacker-controlled data reaches these statements, the server interprets the loaded content as code. This category of flaw is tracked under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program.

Although the advisory title references PHP Remote File Inclusion, the realized impact in the Soleng theme is Local File Inclusion. The allow_url_include directive is disabled by default in modern PHP, which limits remote payload loading. Local inclusion still permits reading of sensitive files and execution of attacker-staged content reachable on the filesystem.

Root Cause

The root cause is missing validation on a request parameter consumed by an include/require statement in the theme's PHP source. The theme does not constrain values to a fixed set of template filenames, does not strip directory traversal sequences such as ../, and does not anchor the path inside a permitted base directory.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a Soleng theme endpoint that processes the vulnerable parameter. The attacker supplies a path that resolves to a sensitive file, such as wp-config.php, or to an attacker-controlled file written through another upload, log, or session vector. The server then includes and processes the referenced file in the context of the web user. See the Patchstack Vulnerability Report for advisory details.

No verified public proof-of-concept code is available. The exploitation mechanism follows the standard LFI pattern of injecting a traversal path into the vulnerable parameter consumed by the include statement.

Detection Methods for CVE-2026-22365

Indicators of Compromise

HTTP requests to Soleng theme PHP files containing directory traversal patterns such as ../, ..%2f, or encoded null bytes
Requests with parameters referencing sensitive paths like wp-config.php, /etc/passwd, or php://filter
Unexpected outbound connections or new PHP files inside the wp-content/themes/soleng/ directory
Web server access logs showing repeated 200 responses to theme endpoints with file path parameters

Detection Strategies

Inspect web access logs for query strings containing php://, file://, or repeated ../ sequences targeting theme paths
Deploy a Web Application Firewall (WAF) rule that blocks path traversal characters in parameters submitted to the Soleng theme
Monitor the WordPress filesystem for unauthorized PHP file creation or modification inside theme directories

Monitoring Recommendations

Enable verbose logging on the PHP include and require call paths through error log review for failed to open stream warnings
Alert on PHP processes that read files outside the WordPress document root
Track integrity of wp-config.php and other sensitive files using file integrity monitoring

How to Mitigate CVE-2026-22365

Immediate Actions Required

Identify all WordPress sites running the Soleng theme and confirm the installed version
Deactivate the Soleng theme if a patched release is not yet available for your installation
Rotate WordPress database credentials, authentication keys, and salts in wp-config.php if exposure is suspected
Apply WAF rules that block directory traversal sequences in HTTP parameters targeting theme paths

Patch Information

The vendor advisory tracked by Patchstack indicates the issue affects Soleng versions up to and including 1.0.5. Refer to the Patchstack Vulnerability Report for fix availability and upgrade guidance from axiomthemes.

Workarounds

Disable the Soleng theme and switch to an unaffected theme until a fixed version ships
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to limit remote inclusion vectors
Restrict web server file system access using open_basedir to confine PHP to the WordPress directory
Place the site behind a WAF with rules that block LFI payloads and path traversal sequences

bash

# Configuration example: harden PHP against file inclusion abuse
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"