The vulnerability CVE-2026-22420 affects AncoraThemes Horizon versions up to 1.1 and is caused by improper control of the filename parameter in PHP include/require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and execute local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official remediation guidance is currently provided, and no known exploits are reported.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is considered severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No specific vendor-provided mitigation or workaround is currently documented.