The vulnerability CVE-2026-22443 affects the ThemeREX Alliance product through improper control of filenames in PHP include/require statements, causing a Local File Inclusion (LFI) vulnerability. This allows an attacker to include unintended local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The issue impacts versions up to and including 3.1.1. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute local files on the server. This may result in sensitive data disclosure, remote code execution, or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, users should monitor vendor communications for updates and consider applying temporary mitigations such as restricting file inclusion paths or disabling vulnerable functionality if feasible.