The vulnerability CVE-2026-22389 affects Mikado-Themes Cocco up to version 2.0 and is caused by improper control of filenames used in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files, code execution, or denial of service. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and potential denial of service on affected Mikado-Themes Cocco installations. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates and patches addressing this vulnerability.