What is the CVSS score of CVE-2026-57800?

CVE-2026-57800 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Overworld Theme are affected by CVE-2026-57800?

The Edge-Themes 'Overworld' WordPress theme (versions ≤1.5) contains a local file inclusion vulnerability allowing authenticated users to disclose sensitive server files including wp-config.php…

How to fix or mitigate CVE-2026-57800?

Within 24 hours, identify all WordPress installations using Overworld theme version 1.5 or earlier and audit user account privileges for potential abuse. Within 7 days, immediately uninstall the vulnerable theme and migrate to an alternative or patched theme, rotate all database and WordPress credentials, and deploy Web Application Firewall rules to block path traversal and PHP inclusion patterns if the theme cannot be immediately removed. Within 30 days, conduct forensic analysis of affected systems to detect exploitation attempts, validate no backdoors were introduced, and implement enhanced monitoring and logging for file access operations.

Overworld Theme CVE-2026-57800

EUVD-2026-43416 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

PHP WordPress Information Disclosure LFI Overworld Wordpress Theme Edge Themes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Authenticated low-priv trigger (PR:L) with non-trivial conditions (AC:H) yields high confidentiality from arbitrary file read, but integrity/availability are limited absent confirmed code execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:29 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The vulnerability is a CWE-98 'Improper Control of Filename for Include/Require Statement' issue within a commercial WordPress theme, identified by CPE cpe:2.3:a:edge-themes:overworld. WordPress themes commonly build dynamic includes from request parameters (e.g. passing a page/template name to include/require without whitelisting), and when that value is attacker-influenced PHP resolves it against the local filesystem. Although CWE-98 is nominally 'Remote File Inclusion,' the advisory scopes the practical impact to Local File Inclusion - meaning traversal to local paths rather than fetching a remote URL, unless allow_url_include is enabled. Because included files are executed by the PHP interpreter, an LFI can escalate beyond pure disclosure if the attacker can plant PHP into a locally readable file (uploads, logs, session files).

RemediationAI

No vendor-released patch version is identified in the available data, so update the Overworld theme to the latest release published by Edge-Themes and consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/overworld/vulnerability/wordpress-overworld-theme-1-5-local-file-inclusion-vulnerability?_s_id=cve) for a fixed build. Until a confirmed fixed version is applied, apply Patchstack's virtual patching / vPatch if you use their WAF, and restrict who can trigger the include: tighten account provisioning so untrusted users cannot obtain the low-privilege role required (PR:L), and restrict access to the vulnerable theme endpoint via web-server or WAF rules that block traversal sequences and unexpected file-path parameters. As PHP-level hardening, ensure allow_url_include and allow_url_fopen are disabled (prevents escalation to true remote inclusion) and set open_basedir to constrain readable paths - note this can break plugins that legitimately read outside the web root, so test before enforcing. If the theme is not essential, switching to a maintained theme eliminates the exposure entirely.