The vulnerability CVE-2026-22512 affects Elated-Themes Roisin theme versions up to 1.2.1. It is caused by improper validation or control of filenames used in PHP include or require statements, which enables a local file inclusion attack. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack vector is network-based but requires high attack complexity and no privileges or user interaction. No patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected server, unauthorized disclosure of sensitive information, and disruption of service. The high CVSS score indicates a significant risk to affected systems. Since the vulnerability allows local file inclusion, attackers may read configuration files, execute malicious scripts, or escalate privileges depending on the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall (WAF) rules to detect and block suspicious include/require requests, and limiting file permissions to reduce potential impact. Monitor official Elated-Themes communications for updates and apply patches promptly once available.