What is the CVSS score of CVE-2026-57790?

CVE-2026-57790 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Billey Theme are affected by CVE-2026-57790?

The Billey WordPress theme (v2.1.8 and earlier) allows authenticated users with standard roles to read sensitive server files including database credentials via Local File Inclusion.

How to fix or mitigate CVE-2026-57790?

Within 24 hours, identify all WordPress instances running Billey v2.1.8 or earlier and restrict new user provisioning on affected sites; increase monitoring for unusual file access patterns targeting configuration files. Within 7 days, contact ThemeMove for patch release timeline; implement Web Application Firewall rules to block wp-config.php requests and path traversal attempts; temporarily disable the theme if WAF implementation is delayed. Within 30 days, apply the vendor patch to all affected instances immediately upon release; if no patch has been released by day 30, migrate affected WordPress installations to an alternative theme and perform forensic analysis of access and error logs to identify any exploitation activity.

Billey Theme CVE-2026-57790

EUVD-2026-43405 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Billey WordPress Wordpress Theme

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Authenticated low-priv access (PR:L) and non-trivial path construction (AC:H); LFI primarily discloses sensitive files (C:H) with only conditional integrity impact (I:L) and no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:33 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

AnalysisAI

Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.

Technical ContextAI

Billey is a commercial WordPress theme distributed by ThemeMove and built on PHP. The root cause is CWE-98, Improper Control of Filename for Include/Require Statement, where user-influenced input reaches a PHP include(), require(), include_once(), or require_once() call without adequate validation or allow-listing. Because the resolvable path is constrained to the local filesystem here, the outcome is Local File Inclusion rather than true remote inclusion - an attacker supplies a path (potentially with traversal sequences) that the theme dereferences and parses as PHP. The single CPE, cpe:2.3:a:thememove:billey:*:*:*:*:*:*:*:*, confirms the affected component is the Billey application/theme across all versions in scope.

RemediationAI

No vendor-released patch version is identified in the available data - the record states the issue affects Billey through <= 2.1.8 without naming a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/billey/vulnerability/wordpress-billey-theme-2-1-8-local-file-inclusion-vulnerability?_s_id=cve) and the ThemeMove changelog for a version above 2.1.8 and upgrade to it as the primary fix once released. Until a patched version is confirmed, apply compensating controls: place a Web Application Firewall (Patchstack, Wordfence, or equivalent) with rules blocking path-traversal and PHP-wrapper payloads in front of the site (trade-off: virtual patching may miss novel encodings); tighten account provisioning so that low-privilege roles capable of reaching the vulnerable code path are minimized or removed (trade-off: may restrict legitimate contributor workflows); and set PHP hardening directives such as open_basedir to constrain includable paths and disable allow_url_include/allow_url_fopen to prevent any remote-inclusion escalation (trade-off: may break plugins that legitimately fetch remote resources). Monitor web logs for suspicious include parameters and traversal sequences.