The vulnerability CVE-2026-22478 affects the Elated-Themes FindAll plugin for PHP, specifically versions up to 1.4. It arises from improper control over the filename used in include or require statements, enabling PHP Local File Inclusion. This allows an attacker to include arbitrary local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute local files. This can result in disclosure of sensitive data, remote code execution, or denial of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin and apply strict input validation or web application firewall rules to mitigate potential exploitation.