Nuss Theme CVE-2026-57799

Exploitation requires the target to run the uxper Nuss WordPress theme at version 1.3.6 or earlier and requires the attacker to hold a valid low-privilege authenticated WordPress session (CVSS PR:L) - not an unauthenticated remote attacker. The flaw is reachable over the network (AV:N) with no user interaction (UI:N), but carries high attack complexity (AC:H), indicating the attacker must control or predict a specific include/require path parameter and satisfy conditions partly outside their control (e.g., a valid local target file resolving through the theme's template-loading logic). Limiting factors that reduce realistic risk: the mandatory authentication requirement, the AC:H conditions, and the requirement that the Nuss theme be installed and active; because the impact is Local (not Remote) File Inclusion, the includable content must already exist on the host.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable with no user interaction, but high attack complexity (AC:H) and a requirement for low-level authentication (PR:L), offset by high impact across all three security properties. No EPSS score, KEV listing, or SSVC decision was provided, so probabilistic and automatability signals are absent. The AC:H plus PR:L combination materially lowers real-world urgency relative to the 7.5 headline: an attacker needs a valid (even low-privilege) WordPress account and must satisfy non-trivial conditions to trigger the inclusion, which argues against trivial mass exploitation. This is a genuine but not top-tier emergency - prioritize where the Nuss theme is active and low-trust accounts (subscribers/contributors) exist, but it is not in the same class as an unauthenticated, low-complexity RCE. No public exploit identified at time of analysis, so exploitation is currently theoretical rather than observed.

An attacker registers or obtains a low-privilege WordPress account on a site running Nuss <= 1.3.6, then sends a crafted authenticated request that manipulates a theme parameter feeding a PHP include/require statement, causing the theme to include an unintended local file. By pointing the inclusion at sensitive configuration or log files (or files containing attacker-controlled PHP), they read secrets or achieve code execution. No public exploit identified at time of analysis, and the high attack complexity means the attacker must satisfy specific conditions to reliably trigger the inclusion.