What is the CVSS score of CVE-2026-57788?

CVE-2026-57788 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2026-57788?

The Edge-Themes 'Aalto' WordPress theme (versions through 1.8) contains a local file inclusion vulnerability (CVE-2026-57788) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-57788?

Within 24 hours: identify all WordPress installations using Edge-Themes 'Aalto' version 1.8 or earlier; disable the theme on all non-business-critical sites and restrict administrative access by IP whitelist. Within 7 days: deploy Web Application Firewall (WAF) rules to block directory traversal and PHP file inclusion patterns; enable enhanced logging on remaining affected installations. Within 30 days: continuously monitor vendor advisory for patch release; if no patch is released within 30 days, execute migration plan to replace the theme with a maintained alternative.

PHP CVE-2026-57788

EUVD-2026-43404 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Aalto

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:35 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

AnalysisAI

Local File Inclusion in the Edge-Themes "Aalto" WordPress theme (all versions up to and including 1.8) lets an authenticated attacker control a filename passed to a PHP include/require statement, exposing local files and potentially executing PHP. The flaw was reported by Patchstack and carries CVSS 7.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Despite the CWE-98 "Remote File Inclusion" classification, the described impact is Local File Inclusion.