Overworld Theme CVE-2026-57800

Exploitation requires an authenticated session at a low privilege level (CVSS PR:L) on a WordPress site running the Edge-Themes Overworld theme at version ≤ 1.5, plus satisfaction of the non-trivial conditions implied by AC:H (the specific request/parameter that reaches the unsafe include must be crafted correctly and any state prerequisites met). The attack is network-reachable (AV:N) and needs no user interaction (UI:N). Limiting factors that reduce real-world risk: the requirement for a valid account means sites that do not allow untrusted user registration are largely protected; the high attack complexity further narrows reliable exploitation; and escalation from file disclosure to code execution additionally depends on the attacker controlling a locally includable file and on PHP configuration (e.g. allow_url_include for remote inclusion). Exact vulnerable parameter/endpoint is not disclosed in the provided data.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) signals a network-reachable, low-privilege attack with no user interaction but high attack complexity, and claims full CIA impact. These signals partially conflict: the Patchstack tags label this 'Information Disclosure / LFI,' which is primarily a confidentiality problem, so the rated I:H and A:H appear optimistic for a straightforward file-read LFI and likely reflect worst-case chaining to code execution rather than a demonstrated impact - verify with the vendor advisory. AC:H and PR:L meaningfully lower real-world risk: an attacker needs a valid (if low-privileged) WordPress account and must satisfy non-trivial conditions to trigger the vulnerable include. There is no KEV listing and no POC referenced, and no EPSS score was supplied, so there is no evidence of active or automated exploitation. Net assessment: a genuine, credible confidentiality risk on affected sites, but not an emergency-tier internet-wormable bug - prioritize based on whether untrusted users can obtain accounts on the site.

An attacker who has registered or been granted a low-privilege WordPress account on a site running Overworld ≤ 1.5 sends a crafted request to the vulnerable theme functionality, supplying a manipulated filename/path parameter that the theme passes into a PHP include/require. The server reads back a sensitive local file such as wp-config.php (exposing database credentials and secret keys), and if the attacker can first plant PHP into a locally accessible file (e.g. poisoned logs or uploads), the inclusion can be turned into code execution. No public POC was referenced, and the high attack complexity (AC:H) means non-trivial conditions must be met.