Aalto WordPress Theme CVE-2026-42777

Exploitation targets the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier, via a web request that reaches the vulnerable PHP file-inclusion sink (CWE-98) without authentication (PR:N) and without user interaction (UI:N). The limiting factor is the CVSS AC:H rating: a non-default or attacker-uncontrolled precondition must be met - for example a specific request parameter/path, a reachable theme code path, or the ability to place/point to includable content - meaning exploitation is not guaranteed against every install. Realistic risk is bounded by the fact that only sites actively running the Aalto theme ≤1.8 are affected; sites on patched versions or using other themes are not exposed.

This is a serious-on-paper but context-dependent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated flaw requiring no user interaction, which argues for priority patching. However, the explicit AC:H (high attack complexity) is the key moderating signal: successful exploitation depends on conditions outside the attacker's full control (e.g., a specific path, parameter, or wrapper state), which is why the score lands at 8.1 rather than 9.8. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent mass exploitation at the time of analysis. Note a plausibility tension worth verifying: the title/tags frame this as 'Local File Inclusion / Information Disclosure' (which typically implies high confidentiality impact only), yet the input vector claims full C:H/I:H/A:H - CWE-98 (PHP file inclusion) can escalate to code execution via remote-file-inclusion or log/wrapper poisoning, so the I:H/A:H rating is defensible only if the flaw permits inclusion of attacker-controlled/executable content; verify the precise sink with Patchstack before treating integrity/availability impact as confirmed. Net: a real vulnerability worth patching on a reasonable cycle, but the absence of exploitation signals plus AC:H place it below drop-everything emergency status for most deployments.

A remote, unauthenticated attacker crafts an HTTP request to a vulnerable Aalto theme endpoint that passes attacker-influenced input into a PHP include/require path, causing the server to include a local file (e.g., wp-config.php or sensitive system files) or, if remote/wrapper inclusion is possible, attacker-controlled PHP. Because AC:H applies, the attacker must satisfy a non-trivial precondition (such as a specific parameter state or achievable local file content) to reliably trigger inclusion. No public exploit identified at time of analysis, so real-world exploitation would require the attacker to independently develop the technique.