PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22331 ThemeREX CVE debrief

CVE-2026-22331 is a high-severity vulnerability in the AutoParts theme, allowing unauthenticated local file inclusion. This vulnerability has a CVSS score of 8.1 and was published on 2026-06-17. The affected version is 1.5.8 or earlier. Users of the AutoParts theme should take immediate action to mitigate this vulnerability. The vulnerability allows attackers to include local files without authentication, potentially leading to sensitive information disclosure or code execution. Organizations using this theme should prioritize patching or updating to a secure version. The CVE record and NVD detail provide further information on this vulnerability.

Vendor
ThemeREX
Product
AutoParts
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Users of the AutoParts theme, version 1.5.8 or earlier, should be aware of this vulnerability and take necessary precautions. Web administrators, security teams, and developers using this theme should prioritize patching or updating to a secure version.

Technical summary

CVE-2026-22331 is a high-severity vulnerability in the AutoParts theme, allowing unauthenticated local file inclusion. The vulnerability has a CVSS score of 8.1 and is classified under CWE-98. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high impact on confidentiality, integrity, and availability. The vulnerability allows attackers to include local files without authentication, potentially leading to sensitive information disclosure or code execution.

Defensive priority

high

Recommended defensive actions

  • Update the AutoParts theme to a secure version
  • Apply patches or hotfixes provided by the vendor
  • Restrict access to sensitive files and directories
  • Implement authentication and authorization mechanisms
  • Monitor for suspicious activity and logs
  • Perform regular security audits and vulnerability assessments

Evidence notes

The vulnerability was reported by Patchstack and is documented in the CVE record and NVD detail. The CVSS score and vector are based on the NVD detail. The CWE classification is based on the audit report from Patchstack.

Official resources

public