CVE-2026-22326: WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability

Synopsis

A local file inclusion vulnerability exists in the Reprizo WordPress theme (versions 1.0.8 and earlier) by AxiomThemes. The flaw is reachable over the network without any authentication, though exploitation requires overcoming environmental conditions that make the attack non-trivial. Successful exploitation gives an attacker the ability to read sensitive files from the server, write or modify content, and crash the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated remote requester.

• Victim interactionNot required

  No user action is required; the attacker sends requests directly to the server without involving a logged-in user.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation depends on specific environmental conditions such as server configuration or file-path enumeration rather than a straightforward, condition-free request.

Blast Radius

• An attacker can read arbitrary files from the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• An attacker can modify or overwrite persisted files on the server, enabling content tampering or injection of malicious code into theme or plugin files.
• An attacker can cause the affected service to crash or become unresponsive by including files that trigger fatal errors or resource exhaustion.