The Mikado-Themes Fleur WordPress theme versions up to 2.2.1 contain a vulnerability classified as CVE-2026-22397, which is an improper control of filenames in PHP include or require statements. This vulnerability enables PHP Local File Inclusion, allowing attackers to include local files on the server. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official fix information is available from the vendor or other sources at this time.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to read sensitive files, execute arbitrary code, and fully compromise the system's confidentiality, integrity, and availability. The high CVSS score reflects the severity of these impacts. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme versions or applying manual code reviews and restrictions to mitigate local file inclusion risks. Monitor vendor channels for updates and patches.