The vulnerability CVE-2026-22457 in Mikado-Themes Wanderland arises from improper validation or control of filenames used in PHP include or require statements. This enables remote file inclusion, where an attacker can supply a crafted filename to include malicious remote code. The affected versions are up to 1.5. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to remote code execution on the affected server, allowing attackers to execute arbitrary code with the privileges of the web server process. This can result in full compromise of the system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling or restricting vulnerable functionality if possible and monitor official Mikado-Themes communications for updates.