The vulnerability CVE-2026-22374 affects AncoraThemes Zio Alberto theme versions up to 1.2.2. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). This can allow an attacker to include unintended files on the server, potentially leading to disclosure of sensitive information or remote code execution depending on server configuration. The CVSS 3.1 score of 8.1 reflects a high impact on confidentiality, integrity, and availability, with a network attack vector but requiring high attack complexity and no privileges or user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt service, resulting in high impact to confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme version and avoid exposing vulnerable installations to untrusted networks. Monitor official AncoraThemes channels for updates.