RT-Theme 18 Extensions CVE-2026-57743

Exploitation targets the include/require path handling in the RT-Theme 18 | Extensions plugin (rt18-extensions <= 2.5) and, per the CVSS vector, requires no authentication (PR:N) and no user interaction (UI:N) over the network (AV:N). However, AC:H signals meaningful limiting factors: the attacker must control or predict a valid local path that the vulnerable parameter resolves to, and turning disclosure into code execution requires a companion primitive such as a poisonable log file, writable upload/session file, or a specific PHP configuration (e.g., allow_url_include enabled for true remote inclusion). Exploitability is further limited to sites that have the rt18-extensions plugin installed and active and expose its vulnerable endpoint; hardened PHP settings (allow_url_include=Off, open_basedir) materially reduce the achievable impact.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) indicates a network-reachable, unauthenticated vulnerability with high impact to confidentiality, integrity, and availability, but with High attack complexity (AC:H) - meaning successful exploitation depends on conditions the attacker does not fully control, such as a specific includable path, PHP configuration, or the presence of a poisonable file. No EPSS score was provided, so exploitation probability cannot be quantified from the input. It is not listed in CISA KEV and no proof-of-concept was referenced, so there is no evidence of active exploitation; the signals point to a genuinely high-severity but not-yet-weaponized issue rather than an urgent in-the-wild threat. The AC:H rating is the key tempering factor and is consistent with LFI-to-RCE typically requiring a secondary primitive (log poisoning, upload, or session file control), so this warrants prompt patching but sits below KEV-listed emergencies in priority.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable rt18-extensions endpoint with a manipulated file-path parameter, steering the plugin's include/require call toward a sensitive server-side file such as wp-config.php or a poisoned log/upload file. Because attack complexity is high, the attacker likely first primes the server (e.g., by seeding malicious content into an includable file) before triggering inclusion to read secrets or execute embedded PHP. No public proof-of-concept was referenced at time of analysis.