The vulnerability CVE-2026-22498 affects the Laurent theme by Elated-Themes, allowing improper control over filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include unintended local files. The affected versions include all versions up to and including 3.1. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity. No patch or remediation details are currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include and execute arbitrary local files on the affected server. This can lead to disclosure of sensitive information, code execution, and full system compromise. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or applying manual code review and hardening to restrict file inclusion paths. Monitor official Elated-Themes communications for updates.