The vulnerability CVE-2026-22418 affects AncoraThemes Great Lotus up to version 1.3.1. It arises from improper control of the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to read sensitive files or execute arbitrary code depending on the server configuration. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. Given the high CVSS score (8.1), the impact is considered severe, potentially allowing attackers to gain significant control over the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor AncoraThemes communications for updates. Until a fix is available, consider restricting access to vulnerable components and applying any available workarounds recommended by the vendor.