The Mikado-Themes Justicia WordPress theme versions up to 1.2 contain a vulnerability classified as CVE-2026-22408, characterized by improper control of the filename parameter in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to potentially execute arbitrary local files on the server. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of the web application and underlying system. The impact includes high confidentiality, integrity, and availability loss as indicated by the CVSS score. However, the attack complexity is high, and no known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme version or applying manual code review and hardening to prevent unsafe file inclusion. Monitor Mikado-Themes advisories for updates and apply patches promptly once available.