The vulnerability CVE-2026-22363 in axiomthemes Rhodos arises from improper validation or control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, allowing attackers to include and execute arbitrary local files on the server. The affected product versions are up to 1.3.3. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, code execution, and potentially full system compromise. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor axiomthemes or Rhodos theme vendor channels for updates. Until a fix is available, consider disabling or removing the affected theme to mitigate risk.