What is the CVSS score of CVE-2026-57795?

CVE-2026-57795 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Kitchor are affected by CVE-2026-57795?

The Kitchor WordPress theme (versions ≤1.4.3) allows authenticated attackers to read sensitive server files including database credentials and potentially execute arbitrary code on WordPress…

How to fix or mitigate CVE-2026-57795?

Within 24 hours: disable the Kitchor theme on all production WordPress sites or verify you run an unaffected version; audit access logs for suspicious include requests targeting wp-config.php or parent directory traversals. Within 7 days: deploy Web Application Firewall rules blocking path traversal patterns (../) and file inclusion attempts against the theme directory; rotate database credentials and verify no unauthorized database access has occurred; scan logs for evidence of sensitive file access by authenticated users. Within 30 days: monitor the Kitchor theme repository for security patch releases and apply immediately upon availability; if no patch emerges, migrate to an alternative WordPress theme; conduct full security audit of affected installations including file integrity verification and database access logs.

Kitchor CVE-2026-57795

EUVD-2026-43411 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

PHP WordPress Information Disclosure LFI Kitchor Wordpress Theme

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Authenticated access needed (PR:L) and a valid traversal path plus inclusion preconditions raise complexity (AC:H); impact is confidentiality-dominant file disclosure (C:H) with only conditional integrity/availability effect (I:L/A:L).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:31 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.

AnalysisAI

Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.

Technical ContextAI

The affected component is Kitchor, a commercial WordPress theme published by the vendor themelexus, identified by CPE cpe:2.3:a:themelexus:kitchor:*:*:*:*:*:*:*:*. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement, 'PHP Remote File Inclusion'), which occurs when a PHP application builds an include(), require(), include_once(), or require_once() path from attacker-controllable input without validating it against an allowlist. In practice on WordPress this typically manifests as a theme file, template loader, or AJAX/query parameter that is concatenated into an include path, letting the attacker traverse the filesystem (../) to pull in unintended local files. While the CWE class name references Remote File Inclusion, both the description and the Patchstack tags explicitly scope this instance to Local File Inclusion and Information Disclosure.

RemediationAI

No vendor-released patch version is identified in the available data - the advisory only bounds the vulnerable range at 1.4.3 and does not name a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/kitchor/vulnerability/wordpress-kitchor-theme-1-4-3-local-file-inclusion-vulnerability?_s_id=cve) and the themelexus vendor page for an update newer than 1.4.3 and upgrade as soon as one is confirmed. Until a fixed version is available, apply compensating controls: use a web application firewall or Patchstack virtual patching to block requests containing directory-traversal sequences and suspicious file-path parameters targeting the theme's endpoints; restrict or remove low-privilege accounts that are not strictly needed, since exploitation requires authenticated access (PR:L); and harden PHP by setting open_basedir to confine include paths and disabling allow_url_include, which limits how far a traversal or remote-inclusion attempt can reach at the cost of possibly breaking legitimate plugins that rely on broad file access. If the theme is not essential, deactivating and replacing it eliminates the exposure entirely.