The vulnerability CVE-2026-22378 affects AncoraThemes Blabber up to version 1.7.0 and arises from improper validation or control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, enabling an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, no privileges required, and no user interaction needed. No official patch or mitigation guidance is currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability can result in an attacker executing arbitrary code or accessing sensitive files on the affected server, leading to full compromise of the system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.