This vulnerability (CVE-2026-39590) is classified under CWE-98, indicating improper control of filenames used in PHP include or require statements, leading to a local file inclusion flaw. It affects ThemeMove's Atomlab product versions up to 2.4.5, allowing unauthenticated attackers to include local files on the server. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows unauthenticated attackers to include arbitrary local files on the server running Atomlab, potentially leading to disclosure of sensitive information, code execution, and full system compromise. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and consider applying temporary mitigations such as disabling vulnerable functionality or restricting file inclusion paths if possible.