The vulnerability CVE-2026-22464 affects the wphocus My auctions allegro plugin for WordPress, specifically versions up to 3.6.33. It involves improper control of the filename parameter in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This flaw allows an attacker with limited privileges to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt service. The impact is rated high due to the potential compromise of confidentiality, integrity, and availability of the affected system. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable plugin and limiting permissions may reduce risk.