Brook Theme CVE-2026-57791

Exploitation requires an authenticated session - the CVSS vector specifies PR:L, so the attacker must already hold at least a low-privilege WordPress account (e.g., subscriber/author) on a site running the Brook theme version 2.9.0 or earlier; no user interaction is needed (UI:N). The vulnerable code path is a PHP include/require statement in the Brook theme that accepts an attacker-influenced filename, so a site must have the Brook theme installed and active. Exploitation is limited by high attack complexity (AC:H), meaning the attacker must meet additional conditions or win a race/state requirement rather than sending a single trivial request, and by the authentication barrier. The exact vulnerable parameter and endpoint are not specified in the available data and should be confirmed via the Patchstack advisory.

The signals are mixed and point to a moderate, not top-tier, priority. The CVSS base score of 7.5 reflects three HIGH impacts (C:H/I:H/A:H) over a network vector, but two mitigating metrics temper real-world risk: AC:H means non-trivial preconditions must be met, and PR:L means the attacker must already be an authenticated WordPress user. No EPSS score was supplied, there is no KEV listing, and no POC was referenced, so all three exploitation-likelihood signals are either low or absent. The I:H/A:H ratings from the source appear generous for a vulnerability that Patchstack tags as 'Information Disclosure / LFI' - pure LFI is primarily a confidentiality issue, though PHP LFI can chain to integrity/availability impact via log poisoning or inclusion of attacker-uploaded files, which likely justifies the vendor's rating. Net: a real vulnerability worth patching, but the authentication requirement and high attack complexity make mass, opportunistic exploitation unlikely.

An attacker who holds or registers a low-privilege WordPress account on a site running Brook <= 2.9.0 crafts a request to a theme endpoint that reaches a PHP include statement, manipulating the filename parameter to traverse to a sensitive local file such as wp-config.php or an attacker-planted file. Because the CVSS vector is network-reachable but high-complexity, the attacker must satisfy specific input/state conditions, but on success can read credentials or chain to code execution via log/upload poisoning. No public POC was referenced at time of analysis.