The vulnerability CVE-2026-22436 in Elated-Themes Helvig arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary code execution or disclosure of sensitive files on the server. The affected versions include all versions up to 1.0. The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, enabling attackers to read sensitive files, execute arbitrary code, and potentially take full control of the affected system. The impact is rated high due to the potential for complete compromise of the system's confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory or Elated-Themes official channels for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected Helvig theme or applying manual code review and hardening to prevent exploitation of the include/require statements.