The vulnerability CVE-2026-22425 affects the Sweet Jane theme by Elated-Themes, where improper validation of filenames used in PHP include or require statements leads to PHP Local File Inclusion. This can allow an unauthenticated remote attacker to include local files on the server, potentially resulting in arbitrary code execution or information disclosure. The issue impacts versions up to and including 1.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to full compromise of the affected web server, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical nature of this vulnerability in terms of potential damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme to mitigate risk. Monitor official Elated-Themes communications for updates on patches or workarounds.