The vulnerability CVE-2026-22403 affects Mikado-Themes Innovio (<= 1.9) and arises from improper validation or control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, which can be exploited remotely over the network without privileges or user interaction. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability allows an attacker to include local files on the affected server, potentially exposing sensitive information, executing arbitrary code, or causing denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor for updates from Mikado-Themes regarding patches or official workarounds.