Flow Theme CVE-2026-57793

Exploitation requires an authenticated session at low privilege (CVSS PR:L) and a request that reaches the Flow theme's vulnerable PHP include/require sink with an attacker-controlled path parameter. The Flow theme (version ≤ 1.8) must be installed and active on the target WordPress site. Attack complexity is High (AC:H), indicating additional constraints - such as specific path traversal encoding, a required existing file, or non-trivial parameter conditions - must be met, and full PHP execution further depends on the attacker being able to place or reference a PHP-bearing file locally. These factors (authentication + AC:H + niche theme dependency) meaningfully limit real-world exploitability despite the network attack vector.

Signals are mixed. CVSS is 7.5 with C:H/I:H/A:H, but the vector tempers this with AC:H (high attack complexity) and PR:L (some authentication/role required), meaning exploitation is not trivial or fully unauthenticated. No EPSS score was provided, there is no POC referenced, and the CVE is not in CISA KEV - so there is no evidence of active or widespread exploitation. This reads as a real but non-emergency issue: a genuine LFI in a niche commercial theme, more likely to be targeted opportunistically after public patch details than mass-exploited. Note a tension worth verifying with the vendor: the CVSS claims full C/I/A impact, which is typical for LFI-to-RCE, yet the description only asserts 'PHP Local File Inclusion' without confirming write/execution primitives - the A:H and I:H may be optimistic unless code execution is demonstrably achievable.

A low-privileged authenticated user (or an attacker who has obtained such credentials) sends a crafted request to the vulnerable Flow theme endpoint, manipulating the include parameter to point at a sensitive local file such as wp-config.php or a previously planted PHP payload. Because AC:H, the attacker likely must satisfy specific path/encoding conditions to succeed. No public POC is referenced, so exploitation would require original research against the theme code.