The vulnerability CVE-2026-22449 affects the Select-Themes Don Peppe theme for WordPress, specifically versions up to 1.3. It arises from improper control over the filename parameter used in PHP include or require statements, which can lead to Local File Inclusion (LFI). This allows an attacker to include files on the server, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score (8.1) indicates critical impacts on confidentiality, integrity, and availability of the affected system. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme (Don Peppe versions up to 1.3) to mitigate risk. Monitor official Select-Themes communications for updates and apply patches promptly once released.