The vulnerability CVE-2026-22457 affects Mikado-Themes Wanderland versions up to 1.5 and is caused by improper control of the filename parameter in PHP include/require statements. This improper validation can lead to PHP Local File Inclusion, allowing attackers to execute arbitrary local files on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially resulting in disclosure of sensitive information, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality or applying temporary mitigations if possible. Monitor vendor channels for updates.