The vulnerability CVE-2026-22452 in ThemeREX Hoverex theme arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially executing arbitrary code or accessing sensitive files on the server. The issue affects Hoverex versions up to 1.5.10. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no patch or official fix information available at this time, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code on the affected server. This results in a high impact on confidentiality, integrity, and availability of the system running the vulnerable Hoverex theme. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor ThemeREX advisories closely. Until a fix is released, consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only.