CVE-2026-22364 is a PHP Local File Inclusion vulnerability in the axiomthemes SevenTrees theme, caused by improper control of filenames in include or require statements. This vulnerability affects versions up to 1.0.2 and can be exploited remotely without privileges or user interaction, though it requires high attack complexity. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once released.