The vulnerability CVE-2026-22381 affects the PawFriends WordPress theme by Mikado-Themes, allowing improper control over filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include unintended files from the server. The affected versions are up to and including 1.3. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official fix details are available from the vendor at this time.

Successful exploitation of this vulnerability could allow an attacker to read or execute arbitrary files on the server hosting the vulnerable WordPress theme. This can lead to disclosure of sensitive information, modification of application data, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or replacing the vulnerable theme to prevent exploitation. Monitoring vendor channels for updates is recommended.