The vulnerability CVE-2026-22424 affects AncoraThemes Shaha versions up to 1.1.2 and is caused by improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion (LFI) vulnerability, where an attacker can cause the application to include unintended local files. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available.

Successful exploitation of this vulnerability allows an attacker to include local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The impact is rated high due to the potential for full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting the vulnerable functionality if possible or applying temporary mitigations such as input validation or web application firewall rules to block malicious requests targeting file inclusion.