CVE-2026-22428highCWE-98

CVE-2026-22428: high-severity vulnerability in AncoraThemes Tooth Fairy

WordPress Tooth Fairy theme <= 1.16 - Local File Inclusion vulnerability

Published · Updated

Follow this CVE+ Monitor Tooth Fairy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
In short

The Tooth Fairy WordPress theme up to version 1.16 has a flaw that allows attackers to include and execute arbitrary files from the server. This could let an attacker access sensitive files or run malicious code on your website.

Technical detail

A PHP Local File Inclusion (LFI) vulnerability exists in the theme's improper handling of filename parameters in include/require statements. An unauthenticated attacker can manipulate input to traverse the filesystem and include arbitrary PHP or sensitive files, potentially leading to information disclosure or remote code execution depending on server configuration and available files.

Summary generated and translated by AI from the official description.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tooth Fairy tooth-fairy allows PHP Local File Inclusion.This issue affects Tooth Fairy: from n/a through <= 1.16.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
AncoraThemes · Tooth Fairy