The vulnerability CVE-2026-22477 affects AncoraThemes Felizia versions up to 1.3.4 and is caused by improper control of the filename used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files, code execution, or denial of service. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector with high impact on confidentiality, integrity, and availability but requiring high attack complexity and no privileges or user interaction. No official patch or vendor advisory is provided in the data.

Successful exploitation of this vulnerability can lead to local file inclusion, enabling attackers to read sensitive files, execute arbitrary code, or disrupt service, severely impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is considered high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality if possible and monitor for updates from AncoraThemes. No vendor advisory or patch links are currently provided.