The vulnerability CVE-2026-22446 affects Select-Themes Prowess (versions up to 1.8.1) and is caused by improper control of filenames in PHP include/require statements. This leads to a Local File Inclusion (LFI) vulnerability, where an attacker can trick the application into including unintended local files. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and tracked but lacks vendor-provided patch or mitigation details at this time.

Successful exploitation of this vulnerability could allow an attacker to read sensitive local files, execute arbitrary code, or disrupt service on the affected system, resulting in full compromise of confidentiality, integrity, and availability. The high CVSS score reflects the potential severity of impact. However, exploitation requires high attack complexity and no privileges or user interaction, which somewhat limits the ease of exploitation. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application, apply web application firewall rules to detect and block suspicious include/require requests, and avoid exposing the application to untrusted networks. Monitor Select-Themes advisories for updates and apply official patches promptly once available.