What is the CVSS score of CVE-2026-57794?

CVE-2026-57794 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Golo Framework are affected by CVE-2026-57794?

uxper Golo Framework WordPress plugin (versions up to 1.7.3) contains a local file inclusion vulnerability allowing authenticated users to read arbitrary server files and execute PHP code.

How to fix or mitigate CVE-2026-57794?

Within 24 hours: inventory all WordPress instances using uxper Golo Framework plugin and confirm versions in use. Within 7 days: disable the plugin on non-critical systems or restrict WordPress user roles with plugin access to essential personnel only; implement file access logging for sensitive directories. Within 30 days: establish monitoring for vendor patch release and create upgrade plan to deploy immediately upon availability; evaluate plugin alternatives if vendor timeline exceeds risk tolerance.

Golo Framework CVE-2026-57794

EUVD-2026-43410 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Golo Framework

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network-reachable but needs a low-privilege account (PR:L) and non-trivial path condition (AC:H); confidentiality high from file disclosure while integrity/availability are lower absent confirmed code execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:31 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3.

AnalysisAI

Local file inclusion in the uxper Golo Framework WordPress plugin (versions up to and including 1.7.3) lets an authenticated attacker abuse an improperly validated include/require path to read arbitrary server-side files and potentially execute embedded PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) indicates network-reachable exploitation requiring low-level authentication and elevated attack complexity, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Golo Framework is a companion plugin distributed with the Golo (uxper) WordPress directory/listing theme, running inside the PHP-based WordPress request lifecycle. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement, 'PHP Remote/Local File Inclusion'): the plugin passes attacker-influenced input into a PHP include()/require() construct without properly constraining it to a whitelist or sanitizing directory traversal sequences. Because PHP's include/require will execute any included file as PHP, such a flaw can escalate from disclosing local files (configuration, wp-config.php-adjacent data) to code execution if an attacker can point the include at content they control. The affected component is identified by CPE cpe:2.3:a:uxper:golo_framework:*:*:*:*:*:*:*:* covering all versions through 1.7.3.

RemediationAI

No vendor-released patch version was identified at time of analysis in the provided data, so upgrade to a fixed release once uxper publishes one and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/golo-framework/vulnerability/wordpress-golo-framework-plugin-1-7-3-local-file-inclusion-vulnerability?_s_id=cve) for the fixed build. As compensating controls until a patch is available: restrict access to the affected plugin endpoints via a WAF rule blocking directory-traversal patterns (../, encoded %2e%2e, and php:///data:// wrappers) targeting the plugin's include parameters, which may break legitimate requests that use path-like parameters and should be tested first; tighten account provisioning so only trusted users hold the low-privilege role needed to authenticate (the PR:L prerequisite), reducing the attacker population; and set PHP allow_url_include=Off and constrain open_basedir to the WordPress docroot to limit which files an include can reach, noting open_basedir can break plugins that legitimately access files outside the docroot. Consider deactivating the Golo Framework plugin if the associated theme functionality is not in active use.