The vulnerability CVE-2026-22418 in AncoraThemes Great Lotus (<= 1.3.1) is caused by improper control of the filename used in PHP include or require statements, leading to a Local File Inclusion (LFI) issue. This can allow attackers to include and execute files on the server, potentially leading to full compromise of the affected system. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official remediation information is provided in the available data.

Successful exploitation can lead to arbitrary code execution, disclosure of sensitive information, and disruption of service on systems running vulnerable versions of Great Lotus. The high CVSS score indicates a severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions of Great Lotus or implement application-level controls to restrict file inclusion paths. Monitor vendor channels for updates and apply patches promptly once released.