The vulnerability identified as CVE-2025-26986 affects the StylemixThemes Pearl - Corporate Business theme for WordPress. It arises from improper control over the filename parameter in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary local files on the server, which may lead to remote code execution or disclosure of sensitive information. The issue affects all versions before 3.4.8. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation of this vulnerability can result in an attacker including and executing arbitrary local files on the affected server. This can lead to full compromise of the system's confidentiality, integrity, and availability. The CVSS score of 8.1 reflects a high impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and ensure that the theme is updated to version 3.4.8 or later once released. Avoid using untrusted input in include or require statements. Monitor official StylemixThemes communications for updates.