What is the CVSS score of CVE-2026-57791?

CVE-2026-57791 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Brook Theme are affected by CVE-2026-57791?

ThemeMove Brook WordPress theme versions 2.9.0 and earlier contain a local file inclusion vulnerability allowing authenticated attackers to read sensitive server files, including database credentials…

How to fix or mitigate CVE-2026-57791?

Within 24 hours, perform an audit of all WordPress installations to identify which sites run ThemeMove Brook theme version 2.9.0 or earlier and assess user account inventory on affected systems. Within 7 days, restrict theme access to only trusted administrator accounts by reviewing and tightening WordPress user role assignments, monitor web server logs and WordPress audit logs for suspicious file access attempts targeting wp-config.php, and document all authenticated users with dashboard access as potential attack surface. Within 30 days, contact the theme vendor to establish a patch release timeline; if no patch is committed within 30 days, execute a planned migration to an alternative WordPress theme and complete deployment across all affected sites.

Brook Theme CVE-2026-57791

EUVD-2026-43407 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Brook

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network-reachable but requires an authenticated low-priv account (PR:L) and non-trivial conditions (AC:H); LFI is primarily confidentiality (C:H) with limited integrity/availability from potential chaining.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:32 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

AnalysisAI

Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Brook is a commercial WordPress theme distributed by ThemeMove and running within the PHP-based WordPress ecosystem, as confirmed by the CPE cpe:2.3:a:thememove:brook:*. The root cause is CWE-98, Improper Control of Filename for Include/Require Statement (classically 'PHP Remote File Inclusion'), where user-influenced input reaches a PHP include(), require(), include_once() or require_once() call without adequate sanitization or allow-listing. Although CWE-98 is titled around remote inclusion, the disclosed impact here is Local File Inclusion - the attacker-controlled path resolves to files already present on the server (or attacker-uploaded content), rather than a remotely hosted URL, which is consistent with typical WordPress hardening that disables allow_url_include.

RemediationAI

No vendor-released patch version was identified at time of analysis - the advisory only bounds the vulnerable range at <= 2.9.0 without naming a fixed release, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/brook/vulnerability/wordpress-brook-theme-2-9-0-local-file-inclusion-vulnerability) and the ThemeMove vendor channel for an update and upgrade to the first release above 2.9.0 as soon as it is published. As compensating controls until a patch exists, restrict or remove low-privilege account self-registration so untrusted users cannot obtain the authentication required (trade-off: breaks membership/registration features), deploy a WAF or Patchstack virtual patch rule to block requests containing path-traversal sequences and suspicious file parameters to the theme's endpoints, set PHP allow_url_include=Off and allow_url_fopen=Off to prevent remote-URL inclusion escalation, and use open_basedir to confine PHP file access to the web root (trade-off: may break plugins that read outside the docroot). Tighten filesystem permissions on wp-config.php and disable the theme if it is not essential.