What is the CVSS score of CVE-2026-57793?

CVE-2026-57793 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Flow Theme are affected by CVE-2026-57793?

The Elated-Themes Flow WordPress theme (versions 1.8 and earlier) contains a local file inclusion vulnerability allowing authenticated users to read sensitive files and potentially execute arbitrary…

How to fix or mitigate CVE-2026-57793?

Within 24 hours, conduct an urgent audit of all WordPress installations to identify sites running Elated-Themes Flow theme and document current versions. Within 7 days, remove the Flow theme entirely and migrate to an alternative theme; if immediate replacement is infeasible, restrict authenticated user privileges to administrators only and disable new user registration during transition. Within 30 days, establish a formal WordPress theme assessment process to audit all existing themes for security issues, update theme procurement standards to exclude unsupported or vulnerable packages, and deploy monitoring for file inclusion attack patterns.

Flow Theme CVE-2026-57793

EUVD-2026-43409 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Flow

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network-reachable theme endpoint but requires a low-priv authenticated account (PR:L) and non-trivial path conditions (AC:H); confidentiality is high via file disclosure, while integrity/availability are lowered absent confirmed code execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:31 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.

AnalysisAI

Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.

Technical ContextAI

Flow is a commercial WordPress theme built by Elated-Themes (ThemeForest/Qode family). The root cause is CWE-98 (PHP Remote/Local File Inclusion), where user-influenced input reaches a PHP include(), require(), or equivalent statement without sufficient sanitization or allow-listing. Per the affected CPE cpe:2.3:a:elated-themes:flow:*, the weakness is in the theme's own PHP code, allowing an attacker to steer the inclusion path toward arbitrary local files rather than the intended template. Because WordPress executes PHP, an included file containing PHP (e.g., an uploaded or log-poisoned file) can result in code execution, not just disclosure - hence the LFI classification and Information Disclosure tag.

RemediationAI

No vendor-released patch version is identified in the available data (the advisory records the issue as affecting 'up to and including 1.8' with no confirmed fixed release). Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/flow/vulnerability/wordpress-flow-theme-1-8-local-file-inclusion-vulnerability) and the Elated-Themes/ThemeForest changelog for a patched build above 1.8 and upgrade as soon as it is published. As compensating controls until then: apply Patchstack (or an equivalent WAF/vPatch) to block the malicious include parameter; restrict who holds authenticated low-privilege accounts on the site since PR:L is required; harden PHP by setting allow_url_include=Off and a restrictive open_basedir to confine any inclusion to the webroot (trade-off: open_basedir can break plugins that read outside the site directory); and restrict access to the vulnerable theme endpoint at the web-server layer. Each control reduces exposure but is not a substitute for the eventual vendor fix.