The vulnerability CVE-2026-22456 in Elated-Themes Askka arises from improper validation of filenames in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files on the server running the vulnerable theme, potentially leading to full system compromise. The issue affects Askka versions up to and including 1.0. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server hosting the vulnerable Askka theme. This may lead to disclosure of sensitive information, modification of data, and disruption of service. Given the high CVSS score, the impact is considered severe, affecting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Askka theme to prevent exploitation. Monitor official Elated-Themes communications for updates and apply patches promptly once available.