The vulnerability CVE-2026-22373 affects AncoraThemes Fooddy through improper control of the filename used in PHP include or require statements. This improper control enables a Local File Inclusion (LFI) attack vector, where an attacker can cause the application to include files from the local filesystem. The affected versions are up to and including 1.3.10. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require parameters. Monitor vendor channels for updates and patches.