This vulnerability (CVE-2026-22324) in ThemeREX Melania arises from improper control of filenames in PHP include/require statements, categorized under CWE-98. It allows PHP Local File Inclusion, which can be exploited remotely over the network without privileges or user interaction. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability. The affected versions include all versions up to 2.5.0. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to local file inclusion, enabling attackers to execute arbitrary code or access sensitive files on the server. The CVSS score indicates high impact on confidentiality, integrity, and availability, meaning attackers could fully compromise the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying any available temporary mitigations recommended by the vendor once available. Avoid exposing the affected application to untrusted networks.