The vulnerability CVE-2026-22375 affects the AncoraThemes Impacto Patronus WordPress theme (versions up to 1.2.3). It is caused by improper control over the filename parameter in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This allows attackers to include local files on the server, which can lead to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits have been detected in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server. This can lead to full compromise of the web server, including disclosure of sensitive data, modification of files, and disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme to prevent exploitation. Monitoring for updates from AncoraThemes is recommended. No vendor advisory or official patch information is currently available.