The AncoraThemes Crown Art theme for WordPress contains a vulnerability identified as CVE-2026-22434, characterized by improper control of filenames in PHP include/require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include local files on the server. The issue affects versions up to 1.2.11. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits are reported.

Successful exploitation of this vulnerability can allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full system compromise including data disclosure, modification, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the vulnerable theme to prevent exploitation. Monitor official AncoraThemes communications for updates and apply any official fixes promptly once released.