What is the CVSS score of CVE-2026-57796?

CVE-2026-57796 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Leedo are affected by CVE-2026-57796?

The VLThemes Leedo WordPress theme (versions ≤3.0.0) enables authenticated users to include and execute arbitrary files from the server, exposing sensitive configuration data and creating code…

How to fix or mitigate CVE-2026-57796?

Within 24 hours: disable the VLThemes Leedo theme in production or restrict its features to administrators only; audit active user accounts with access to theme functionality. Within 7 days: identify replacement WordPress themes, contact VLThemes for security update timeline, and prepare migration documentation. Within 30 days: migrate to a hardened alternative theme, remove VLThemes Leedo from the server entirely, and verify no residual theme files remain accessible.

Leedo CVE-2026-57796

EUVD-2026-43412 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Leedo WordPress Wordpress Theme

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable but requires an authenticated low-privilege account (PR:L) and non-trivial conditions to control the include path (AC:H); LFI can disclose secrets and enable local code execution, so C/I/A all High.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:30 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.

AnalysisAI

Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.

Technical ContextAI

The affected component is Leedo, a commercial WordPress theme distributed by VLThemes, running within the PHP-based WordPress ecosystem. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), where a user-influenced value reaches a PHP include(), require(), include_once(), or require_once() call without sufficient validation or allow-listing of the target path. Because the input is not constrained to an intended set of files, an attacker can steer the include toward unintended local paths (Local File Inclusion), and in classic PHP RFI patterns toward remote paths when allow_url_include is enabled - though Patchstack scopes the confirmed impact here to LFI. The affected product is identified by CPE cpe:2.3:a:vlthemes:leedo:*:*:*:*:*:*:*:* covering all versions through 3.0.0.

RemediationAI

No vendor-released patch version is identified at time of analysis; the advisory (https://patchstack.com/database/Wordpress/Theme/leedo/vulnerability/wordpress-leedo-theme-3-0-0-local-file-inclusion-vulnerability?_s_id=cve) marks all versions up to and including 3.0.0 as affected without naming a fixed build. Administrators should check VLThemes for a release later than 3.0.0 and upgrade immediately once available. Until then, apply specific compensating controls: use a virtual-patching WAF (such as Patchstack's own module) to filter the vulnerable include parameter, tighten access by removing or restricting the low-privilege authenticated accounts that satisfy the PR:L requirement, and set PHP allow_url_include=Off and allow_url_fopen=Off in php.ini to block any remote-inclusion escalation (trade-off: may break plugins that legitimately fetch remote resources). If the theme is not essential, deactivate and replace it, accepting the site-appearance impact. Restrict filesystem permissions and open_basedir to limit which local files the web process can read (trade-off: misconfiguration can break legitimate file access).