The vulnerability CVE-2026-22361 affects axiomthemes A-Mart versions up to 1.0.2 and is caused by improper validation or control of filenames used in PHP include or require statements. This leads to PHP Local File Inclusion, enabling an attacker to include arbitrary files on the server, potentially resulting in remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction. No patch or vendor advisory details are currently available.

Successful exploitation of this vulnerability can allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data leakage, or denial of service. The impact affects confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require requests, and monitoring for unusual file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.