The vulnerability CVE-2026-22361 affects the A-Mart product by axiomthemes, specifically versions up to and including 1.0.2. It arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion (LFI). This can allow an attacker to read sensitive files or execute arbitrary code depending on the server configuration. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and potential full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. Since the vulnerability allows local file inclusion, attackers may access configuration files, source code, or other sensitive data stored on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable functionality, applying web application firewalls to detect and block suspicious requests, and limiting file system permissions to reduce potential impact. Monitor vendor channels for updates and apply patches promptly once available.