The vulnerability CVE-2026-22421 affects AncoraThemes Quantum up to version 1.0 and is characterized by improper control over the filename parameter in PHP include or require statements. This weakness can lead to PHP Local File Inclusion, where an attacker may trick the application into including unintended local files, potentially leading to code execution or information disclosure. The CVSS 3.1 base score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running AncoraThemes Quantum. This could result in unauthorized data access, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should monitor the vendor's communications for updates. Avoid exposing vulnerable versions to untrusted networks and consider restricting file inclusion functionality if possible.