What is the CVSS score of CVE-2026-57743?

CVE-2026-57743 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of RT-Theme 18 Extensions are affected by CVE-2026-57743?

The WordPress rt18-extensions plugin (versions through 2.5) contains a remote local file inclusion vulnerability that allows unauthenticated attackers to access sensitive server files and potentially…

How to fix or mitigate CVE-2026-57743?

Within 24 hours, identify all WordPress instances using rt18-extensions plugin version 2.5 or earlier and assess their internet accessibility; immediately disable or uninstall the plugin on all affected systems. Within 7 days, implement Web Application Firewall rules to block requests to rt18-extensions plugin paths, enable detailed logging for the plugin directory, and search existing server logs for signs of exploitation. Within 30 days, monitor WordPress and plugin vendor advisory channels for security updates; if no patch is released, evaluate and migrate to alternative, actively maintained plugins with documented security practices.

RT-Theme 18 Extensions CVE-2026-57743

EUVD-2026-43386 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Rt Theme 18 Extensions

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H because LFI-to-RCE needs a specific includable/poisonable path, with full C/I/A impact once achieved.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:39 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

AnalysisAI

PHP Local File Inclusion in the WordPress RT-Theme 18 | Extensions plugin (rt18-extensions) by stmcan lets remote attackers coerce the plugin into including attacker-influenced local file paths in an include/require statement, exposing sensitive files and potentially achieving code execution if a suitable includable file exists. All versions from an unspecified start through 2.5 are affected. No public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 3.1 base score is 8.1 (high) and the flaw is reachable without authentication.

Technical ContextAI

The affected component is a WordPress theme add-on plugin (rt18-extensions) written in PHP, running inside the WordPress request lifecycle where PHP's include/require constructs load code at runtime. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement, 'PHP Remote File Inclusion'), meaning a filename or path used in an include/require statement is derived from request-controlled input without sufficient allow-listing or path normalization. Although the CWE is titled RFI, the description scopes the practical impact to PHP Local File Inclusion, so an attacker manipulates the path to reference files already present on the server (e.g., configuration files, uploaded content, or PHP log/session data) rather than a remote URL. The single affected package per the CPE is cpe:2.3:a:stmcan:rt-theme_18_|_extensions:*, a niche commercial theme extension.

RemediationAI

No vendor-released patched version is identified in the available data - the advisory records the flaw as affecting rt18-extensions up to and including 2.5 without naming a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/rt18-extensions/vulnerability/wordpress-rt-theme-18-extensions-plugin-2-5-local-file-inclusion-vulnerability) and the stmcan vendor channel for an update beyond 2.5 and upgrade as soon as one is published. Until a fix is confirmed, compensating controls include deploying a WordPress WAF (such as Patchstack's virtual patch) or ModSecurity rules to block requests containing path-traversal sequences or file-scheme parameters to the plugin's endpoints; restricting or disabling the rt18-extensions plugin if the theme feature set is not essential (trade-off: dependent theme functionality breaks); hardening PHP with open_basedir and allow_url_include=Off to constrain what include paths can resolve to (trade-off: may affect legitimate plugins relying on broad file access); and removing world-readable sensitive files and locking down upload directories to limit what an inclusion could disclose or poison.