The vulnerability CVE-2026-22424 affects the AncoraThemes Shaha WordPress theme through improper control of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, potentially allowing an attacker to execute arbitrary code or access sensitive files on the server. The issue impacts versions up to and including 1.1.2. The CVSS 3.1 vector indicates the attack requires network access, has high attack complexity, no privileges or user interaction needed, and results in high confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. There are currently no known exploits in the wild, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of AncoraThemes Shaha theme should monitor for updates from the vendor. Until a fix is available, consider disabling or removing the affected theme to mitigate risk.