The vulnerability CVE-2026-22456 in Elated-Themes Askka arises from improper validation of filenames in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files, potentially compromising the system. The issue affects Askka versions up to 1.0. The CVSS 3.1 base score is 8.1, reflecting high impact and network attack vector with high attack complexity and no privileges required. There is no indication of an official fix or patch at this time, and no known exploitation in the wild has been documented.

Successful exploitation of this vulnerability could lead to arbitrary local file inclusion, which may result in disclosure of sensitive information, code execution, and full compromise of the affected system. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability. However, no known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected Askka theme if feasible. Monitor Elated-Themes communications for updates and apply patches promptly once available.