The vulnerability CVE-2026-22385 affects don-themes Wolmart up to version 1.9.6 and is characterized by improper control over filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include arbitrary files on the server. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation has been documented yet, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or access sensitive files on the affected server, leading to complete compromise of confidentiality, integrity, and availability of the system running Wolmart. Given the high CVSS score, the impact is considered severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor for updates from don-themes regarding patches or security advisories.