What is the CVSS score of CVE-2026-57789?

CVE-2026-57789 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Aqua theme are affected by CVE-2026-57789?

WordPress sites using jwsthemes Aqua theme versions 5.1.2 or earlier face authenticated file access vulnerabilities that could expose sensitive configuration and database credentials, with no current…

How to fix or mitigate CVE-2026-57789?

Within 24 hours, identify all WordPress installations running jwsthemes Aqua theme versions 5.1.2 or earlier and immediately audit active user accounts, disabling any unnecessary low-privilege accounts and enforcing strong password policies. Within 7 days, enforce multi-factor authentication for all WordPress administrative users, implement request-level logging and monitoring to detect suspicious file access patterns, and apply web server rate-limiting to restrict rapid file inclusion attempts. Within 30 days, develop and execute a theme migration plan to replace Aqua with a maintained WordPress theme, conduct a comprehensive audit of application and access logs for exploitation indicators, and perform security testing on the replacement theme before full deployment.

Aqua theme CVE-2026-57789

EUVD-2026-43406 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Aqua WordPress Wordpress Theme

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Authenticated LFI (PR:L) over the network with non-trivial exploitation (AC:H) clearly discloses files (C:H); integrity/availability only via unconfirmed code-execution chaining, so I:L/A:L rather than high.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:34 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.

AnalysisAI

Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lies in how the Aqua theme handles a filename passed to a PHP include or require statement (CWE-98, 'Improper Control of Filename for Include/Require Statement'). When user-influenced input reaches these constructs without proper allowlisting or path canonicalization, PHP will resolve and execute or read the referenced file. The single CPE in scope, cpe:2.3:a:jwsthemes:aqua:*:*:*:*:*:*:*:*, is a commercial WordPress theme, so exploitation occurs within the PHP execution context of a WordPress installation. Although CWE-98 is the classic Remote File Inclusion class, the advisory explicitly scopes the impact to Local File Inclusion, meaning inclusion of remote URLs is not demonstrated; the practical impact is disclosure of local files (e.g. wp-config.php, credentials, keys) and possible escalation to code execution through techniques such as log poisoning or inclusion of an attacker-planted PHP file.

RemediationAI

No vendor-released patch version is identified at time of analysis - the data specifies impact 'through <= 5.1.2' without naming a fixed build - so monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/aqua/vulnerability/wordpress-aqua-theme-5-1-2-local-file-inclusion-vulnerability) and the jwsthemes vendor channel and upgrade to any release later than 5.1.2 as soon as it is published. Until a fixed version exists, restrict which accounts hold the low-privilege role required to reach the vulnerable include, and place a WAF or virtual patch (Patchstack offers one for this entry) in front of the theme to block path-traversal sequences and file-inclusion payloads; note that aggressive WAF rules on include parameters can break legitimate theme functionality, so test them. As a stronger compensating control, deploy PHP hardening - set open_basedir to confine the include path, disable allow_url_include, and remove write access to web-readable log/upload paths that could be abused for log-poisoning escalation - accepting that open_basedir restrictions may interfere with plugins that legitimately read outside the webroot.