The vulnerability CVE-2026-22385 affects don-themes Wolmart (versions up to 1.9.6) and is characterized by improper control over the filename parameter in PHP include or require statements. This improper control enables PHP Local File Inclusion, where an attacker can cause the application to load and execute files from the local filesystem that were not intended to be included. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could lead to an attacker reading arbitrary files on the server, executing arbitrary code, and causing a full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score indicates severe impact if exploited. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor don-themes Wolmart vendor communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests may help mitigate risk.