The vulnerability CVE-2026-22506 in Elated-Themes Amoli arises from improper control over filenames used in PHP include or require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. The affected product versions include Amoli up to 1.0. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. This may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. The high CVSS score reflects the critical nature of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme or applying manual code review and hardening to prevent inclusion of untrusted files. Monitor vendor channels for updates.