The vulnerability CVE-2026-22377 affects AncoraThemes Saveo versions up to 1.1.2 and is caused by improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, enabling an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a network attack vector with high impact on confidentiality, integrity, and availability, though requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute arbitrary code or access sensitive files on the affected server, potentially leading to full system compromise. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor AncoraThemes communications for updates. In the meantime, restricting access to vulnerable endpoints and employing web application firewalls to detect and block suspicious include/require requests may help mitigate risk.