CVE-2026-22330: WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability

Synopsis

Local File Inclusion (LFI) is a vulnerability that lets an attacker force a web application to load arbitrary files from the server's filesystem. This CVE affects the Right Way WordPress theme by Themeum, versions 4.0 and below, and is reachable over the network with no authentication required. Successful exploitation gives an attacker the ability to read sensitive files on the server, and in common WordPress environments where file upload is possible, can be chained into full remote code execution, data tampering, or service disruption. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the vulnerability is exploitable by any unauthenticated network request.

• Victim interactionNot required

  No user action is needed on the target server; the attacker sends a crafted request directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation may depend on specific server configuration or require chaining with another condition such as a writable upload directory for code execution.

Blast Radius

• An attacker can read arbitrary files from the server filesystem, including WordPress configuration files such as wp-config.php that contain database credentials.
• Credential exposure from those files enables database access, allowing an attacker to read, modify, or delete stored posts, user records, and session tokens.
• In environments where file upload is permitted, LFI can be chained to execute attacker-supplied code, resulting in full server compromise.
• All three impact dimensions (confidentiality, integrity, and availability) are rated High by the CVSS score, meaning the attacker gains broad control over the affected host.