The vulnerability CVE-2026-22372 affects AncoraThemes Isida up to version 1.4.2 and is caused by improper control of the filename used in PHP include or require statements. This leads to PHP Local File Inclusion, which can allow an attacker to execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the affected server, potentially leading to full compromise of the system's confidentiality, integrity, and availability. This can result in unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible and apply strict input validation or filtering on filenames used in include/require statements to mitigate risk.