Billey Theme CVE-2026-57790

Exploitation requires an authenticated session with at least low-level privileges on the target WordPress site (CVSS PR:L), so anonymous/unauthenticated abuse is not indicated by the available data. The specific prerequisite is reaching the Billey theme code path that passes attacker-influenced input into a PHP include/require statement; the target must be running Billey version 2.1.8 or earlier. Exploitation is further limited by high attack complexity (AC:H), meaning success depends on non-trivial conditions such as precise payload/path construction rather than a single trivial request. No user interaction is required (UI:N). The vulnerability is scoped to the Billey theme, so sites not running this theme are unaffected.

The signals are mixed and warrant careful triage. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) describes a network-reachable but high-complexity attack requiring low-level authentication - meaning the attacker already needs a valid, if limited, account on the WordPress site, and exploitation is non-trivial. The reported base score of 7.5 is elevated largely by the C:H/I:H/A:H impact triad, which is generous for a vulnerability the Patchstack tags characterize primarily as 'Information Disclosure / LFI'; a pure LFI's realistic impact is weighted toward confidentiality. No EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or imminent widespread exploitation. Net assessment: a legitimate but moderate-priority issue - the authentication requirement (PR:L) and high attack complexity (AC:H) meaningfully limit real-world exploitability, so it ranks below unauthenticated, low-complexity theme/plugin flaws. Note the tension: CWE-98 is nominally 'Remote File Inclusion' yet the description explicitly states Local File Inclusion - verify the true inclusion behavior with the vendor advisory before assuming remote-URL inclusion is possible.

An attacker who holds or obtains a low-privilege authenticated WordPress account on a site running Billey <= 2.1.8 crafts a request to the vulnerable theme endpoint supplying a manipulated filename parameter that resolves to a sensitive local file (e.g., wp-config.php), causing the PHP include to disclose database credentials and secret keys. Given AC:H, the request likely requires specific parameter shaping or state to succeed, and under conditions permitting inclusion of attacker-controlled log or upload content it could be chained toward code execution. No public exploit is identified at time of analysis.