Dor Theme CVE-2026-57792

Exploitation requires an authenticated WordPress session at a low privilege level (CVSS PR:L) and interaction with the Dor theme feature that passes a request-supplied filename into a PHP include/require statement; the attacker must craft that parameter to reference a local file (via traversal or a PHP wrapper) targeted by the vulnerable loader. Limiting factors: CVSS AC:H indicates success depends on conditions outside the attacker's full control (path/prefix or suffix constraints, allowed extensions, or filesystem layout), no user interaction is needed (UI:N), and only sites actually running the Dor theme version 2.4.1 or earlier are exposed. Sites that disable open registration remove the readily available low-privilege foothold and substantially reduce exposure.

Signals are moderate and partially conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) indicates network reach with full CIA impact, but two metrics temper real-world risk: PR:L means the attacker must already hold an authenticated low-privilege WordPress account, and AC:H means exploitation depends on conditions the attacker cannot fully control (e.g. specific configuration, path constraints, or timing). No EPSS score was provided, the CVE is not in CISA KEV, and no POC was referenced, so there is no evidence of active or automated exploitation. This is a credible priority for sites running the Dor theme that allow untrusted user registration, but for typical closed-membership WordPress installs the PR:L + AC:H combination makes mass exploitation unlikely. Treat as an important patch item rather than an emergency, and reassess if a POC or EPSS uplift appears.

An attacker registers or obtains a low-privilege account (e.g. subscriber) on a WordPress site running the Dor theme, then sends a crafted request to a theme handler that builds a PHP include path from a request parameter, pointing it at a sensitive local file or a file whose content they can influence (such as an uploaded file or a log). Under the required conditions this discloses server-side files or causes included content to execute as PHP. No public POC was referenced, and the CVSS AC:H rating implies the attacker must satisfy specific path or configuration constraints for reliable success.