The vulnerability CVE-2026-22478 affects the Elated-Themes FindAll plugin up to version 1.4. It arises from improper control over the filename parameter used in PHP include or require statements, which leads to a Local File Inclusion (LFI) vulnerability. This allows an attacker to include arbitrary local files on the server, potentially leading to code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is network exploitable without privileges or user interaction but requires high attack complexity.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or disclose sensitive files on the affected system. This compromises confidentiality, integrity, and availability of the system running the vulnerable FindAll plugin. The high CVSS score indicates a serious threat if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable FindAll plugin version 1.4 or earlier. Monitor official Elated-Themes communications for updates and apply patches promptly once available.