The vulnerability CVE-2026-22415 affects AncoraThemes The Mounty versions up to 1.1. It is caused by improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official patch or vendor advisory is available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running The Mounty theme. This can result in data leakage, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to affected PHP scripts to trusted users only. Monitor official AncoraThemes channels for updates.