The vulnerability CVE-2026-22419 affects the AncoraThemes Honor theme for WordPress, specifically versions up to 2.3. It arises from improper validation or control of filenames passed to PHP include or require statements, enabling local file inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to remote code execution or disclosure of sensitive files on the affected server, resulting in full compromise of the system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is considered severe. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to the affected files to mitigate risk. Monitoring for updates from AncoraThemes is recommended.