This vulnerability (CVE-2026-22330) in Themeum Right Way (<=4.0) is classified as CWE-98, indicating improper control of filenames in PHP include/require statements. It allows unauthenticated attackers to perform Local File Inclusion, which can lead to remote code execution or disclosure of sensitive files. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor as of the published date. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, unauthorized code execution, and disruption of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks.