CVE-2026-22331: WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability

Synopsis

This is a local file inclusion vulnerability in the ThemeREX AutoParts WordPress theme, affecting all versions up to and including 1.5.8. The vulnerability is reachable over the network without any authentication, though exploitation requires the attacker to navigate specific environmental conditions tied to how file paths are resolved. Successful exploitation gives an attacker the ability to read sensitive files on the server, tamper with application data, and crash or destabilize the service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session token is required; the vulnerable code path is accessible to anonymous HTTP requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the target site.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental or configuration conditions, such as server file layout or PHP include-path handling, before the inclusion can be triggered reliably.

Blast Radius

• A successful attacker can read arbitrary files on the server, including PHP configuration files, environment files, and other secrets stored on disk.
• The attacker can tamper with application data or inject malicious content by leveraging writable file paths surfaced through the inclusion mechanism.
• Depending on server configuration, the attacker can trigger conditions that crash or destabilize the WordPress process, causing service disruption.
• If a file containing executable PHP code is included, the vulnerability can escalate to remote code execution on the host.