What is the CVSS score of CVE-2026-57792?

CVE-2026-57792 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dor Theme are affected by CVE-2026-57792?

The Mikado-Themes 'Dor' WordPress theme (versions through 2.4.1) contains a high-severity local file inclusion vulnerability (CVE-2026-57792, CVSS 7.5) enabling low-privilege authenticated users to…

How to fix or mitigate CVE-2026-57792?

Within 24 hours: Identify all WordPress installations using Mikado-Themes 'Dor' version 2.4.1 or earlier and immediately deactivate the theme to prevent exploitation. Within 7 days: Remove the vulnerable theme and deploy an alternative, actively maintained WordPress theme across all affected systems; review WordPress access logs for suspicious activity during the vulnerability window. Within 30 days: Conduct a full security audit of affected installations for evidence of unauthorized access to wp-config.php and database credentials; implement stricter WordPress user role policies to limit low-privilege user capabilities.

Dor Theme CVE-2026-57792

EUVD-2026-43408 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP D R

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable but requires an authenticated low-privilege account (PR:L) and specific path/config conditions (AC:H); LFI-to-code-execution justifies high C/I/A.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:33 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.

AnalysisAI

Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.

Technical ContextAI

The affected component is the "Dor" commercial WordPress theme from Mikado-Themes, tracked by CPE cpe:2.3:a:mikado-themes:dor:*. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement, a.k.a. PHP Remote/Local File Inclusion): PHP code uses attacker-influenced input to build the path passed to include/require without adequately restricting it to an allow-listed directory or sanitizing traversal sequences. In WordPress themes this pattern commonly appears in AJAX handlers, shortcode loaders, or template/module dispatchers that load a file based on a request parameter. Because PHP evaluates included files as code, a successful LFI can escalate from file disclosure to arbitrary PHP execution when the attacker can point the include at a file containing controllable content.

RemediationAI

No vendor-released patch version is identified in the available data, so confirm the fixed release directly with Mikado-Themes or via the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/dor/vulnerability/wordpress-doer-theme-2-4-1-local-file-inclusion-vulnerability?_s_id=cve) and upgrade to any release later than 2.4.1 once available. As compensating controls until a patched version is confirmed: restrict or disable new user self-registration so no untrusted low-privilege accounts exist to meet the PR:L prerequisite; deploy a WordPress WAF (Patchstack or equivalent) with virtual-patching rules for this theme; and block or filter requests to the theme's file-loading endpoints (AJAX actions, shortcode/module loaders) that accept a filename or path parameter, watching for directory-traversal sequences (../, php://, encoded variants). Note trade-offs: disabling registration breaks membership workflows, and aggressive endpoint filtering may break legitimate theme functionality, so test in staging.