The vulnerability CVE-2026-22425 affects the Sweet Jane theme by Elated-Themes, allowing improper control over filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include unintended local files. The vulnerability affects versions up to 1.2 and has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix details are currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to read or execute arbitrary local files on the server hosting the Sweet Jane theme. This can lead to disclosure of sensitive information, code execution, and potentially full system compromise. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected Sweet Jane theme versions or applying manual code review and hardening to prevent inclusion of arbitrary files. Monitoring vendor channels for updates is strongly recommended.