The vulnerability CVE-2026-22435 affects AncoraThemes ElectroServ up to version 1.3.2. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include unauthorized local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction. No patch or official fix information is provided in the available data.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. This may allow attackers to execute arbitrary code or access sensitive files. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions, applying any available workarounds from the vendor, or disabling the affected functionality if possible.