The vulnerability CVE-2026-22434 affects the AncoraThemes Crown Art WordPress theme through improper validation of filenames used in PHP include or require statements. This results in a Local File Inclusion vulnerability, which can be exploited to execute arbitrary code or disclose sensitive files on the server. The issue affects versions up to 1.2.11. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include and execute arbitrary local files on the affected server. This can lead to full compromise of the web application, disclosure of sensitive information, and potential disruption of service. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme to mitigate risk. Monitoring for updates from AncoraThemes or trusted security sources is recommended.