The vulnerability CVE-2026-22477 affects AncoraThemes Felizia versions up to 1.3.4 and is caused by improper control of the filename parameter used in PHP include or require statements. This leads to PHP Local File Inclusion, which can allow an attacker to include and execute local files on the server, potentially resulting in remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, leading to arbitrary code execution, data disclosure, and potential full system compromise. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No official patch or workaround information is currently provided.