The vulnerability CVE-2026-22449 in Select-Themes Don Peppe arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows local file inclusion (LFI), enabling an attacker to include and execute files on the server that should not be accessible. The CVSS score of 8.1 reflects a high impact with network attack vector, high confidentiality, integrity, and availability impacts, and no privileges or user interaction required. The affected versions include all releases up to and including 1.3. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service on affected systems running Select-Themes Don Peppe up to version 1.3. The high CVSS score indicates severe potential impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and review PHP include/require usage to ensure proper input validation. Avoid exposing the affected application to untrusted networks where possible.