The vulnerability CVE-2026-22439 affects AncoraThemes Green Planet up to version 1.1.14 and is caused by improper validation of filenames in PHP include or require statements. This leads to a Local File Inclusion (LFI) vulnerability, which can be exploited to include unauthorized files on the server, potentially resulting in code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected system by allowing attackers to include and execute arbitrary local files. This impacts confidentiality, integrity, and availability of the system. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and consider disabling or restricting PHP include/require functionality if possible.