CVE-2026-22325: WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability affects the Promo WordPress theme by AxiomThemes, versions 1.3.0 and earlier. The vulnerability is reachable over the network and requires no authentication, though exploitation involves elevated attack complexity due to environmental conditions. Successful exploitation gives an attacker full read access to files on the server, the ability to tamper with data, and can result in complete service disruption or remote code execution in common LFI escalation scenarios. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network, meaning an attacker must be able to send HTTP requests to the exposed WordPress installation.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerable code path is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side and does not require any action from an administrator or other user.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation is not straightforward and may depend on specific server configurations, enabled PHP wrappers, or other environmental factors that the attacker must account for.

Blast Radius

• A successful attacker reads arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• An attacker who escalates the LFI to code execution (for example via PHP session file poisoning or log injection) gains the ability to write or modify files on the server.
• Full availability impact is possible, meaning an attacker can disrupt or crash the affected WordPress service.