Golo Framework CVE-2026-57794

Exploitation requires an authenticated session at low privilege (CVSS PR:L) - a valid WordPress account on a site running Golo Framework <= 1.7.3 with the plugin active; it is network-reachable (AV:N) and needs no user interaction (UI:N). The attacker must reach the specific plugin code path that feeds attacker-controlled input into a PHP include/require statement and craft input that satisfies the vulnerable path-handling logic. Limiting factors: the AC:H rating signals a non-trivial precondition or request-shaping requirement rather than a trivial one-shot LFI, and the requirement for a pre-existing authenticated account (versus unauthenticated access) meaningfully narrows who can attack; sites that do not run the Golo Framework plugin or that restrict registration are not exposed.

The signals are mixed and should temper prioritization. The 7.5 CVSS is driven by high C/I/A impact, but the vector marks AC:H (elevated complexity - the attacker likely needs a specific request shape or path-traversal condition to succeed) and PR:L (a valid low-privilege authenticated account is required), which meaningfully raises the bar versus an unauthenticated drive-by LFI. No EPSS score, SSVC decision, KEV listing, or POC was provided in the source data, so there is no evidence of active exploitation or automatable mass-exploitation; this reads as a real but not emergency-tier issue absent further exploit intelligence. One caveat to verify: Patchstack classifies this as Local File Inclusion and tags it 'Information Disclosure,' yet the CVSS vector asserts high integrity and availability impact - if practical impact is read-only file disclosure, the I:H/A:H ratings may be optimistic and should be confirmed against the vendor advisory.

An attacker who holds or registers a low-privilege authenticated WordPress account sends a crafted request to a Golo Framework endpoint, supplying a manipulated filename parameter that traverses out of the intended directory into a sensitive file. Because PHP evaluates included files, the attacker discloses configuration/secrets and, if they can influence includable content, may achieve code execution. No public proof-of-concept was provided, and the AC:H rating suggests the successful request requires a specific, non-trivial condition to be met.