The vulnerability CVE-2026-22443 in ThemeREX Alliance arises from improper validation of filenames in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), enabling the inclusion of unintended local files on the server. The affected versions are all versions up to and including 3.1.1. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is significant if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible, and monitor for any updates from ThemeREX regarding patches or mitigations.