The vulnerability CVE-2026-22356 in Automattic Jetpack CRM arises from improper validation of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited to execute arbitrary code or disclose sensitive information by including unintended local files. The issue affects Jetpack CRM versions up to 6.7.0. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files on the server running the vulnerable Jetpack CRM instance. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Automattic's advisories for updates. Until a fix is available, consider restricting access to the affected application and applying any recommended temporary mitigations from the vendor if published.