AncoraThemes Blabber versions up to 1.7.0 contain a vulnerability classified as CVE-2026-22378, where improper control of the filename parameter in PHP include or require statements leads to PHP Local File Inclusion. This allows an attacker to include local files on the server, potentially exposing sensitive information or enabling code execution. The vulnerability is remotely exploitable without authentication but requires high attack complexity. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in disclosure of sensitive files, unauthorized code execution, and disruption of service on affected Blabber installations. The high CVSS score indicates significant risk to affected systems. No known exploits are currently reported in the wild.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests related to file inclusion attempts.