The vulnerability CVE-2026-22380 affects AncoraThemes UnlimHost versions up to 1.2.3 and is caused by improper control over the filename parameter used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, allowing an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with an attack vector over the network but requiring high attack complexity. No official patch or remediation guidance is currently documented, and no known exploits have been observed in the wild.

Successful exploitation can lead to local file inclusion, potentially allowing attackers to execute arbitrary code, disclose sensitive information, or disrupt service availability on affected UnlimHost installations. The vulnerability impacts confidentiality, integrity, and availability at a high level. However, no known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to vulnerable endpoints and consider disabling or limiting PHP include/require functionality where feasible. Monitor AncoraThemes communications for updates and apply patches promptly once available.