SetSail CVE-2026-57801

Exploitation requires an authenticated session - the CVSS vector specifies PR:L, so a valid low-privilege WordPress account (e.g., subscriber/contributor-level access) on the target site is a prerequisite, and no user interaction is needed (UI:N). The attacker must reach the specific SetSail theme code path that passes attacker-controlled input into a PHP include/require statement and be able to traverse to a target local file. Exploitation is further limited by AC:H, indicating meaningful preconditions or non-deterministic factors (such as specific server configuration, path-resolution constraints, or the need to place/poison a local file for code execution rather than mere disclosure); the theme must be installed and active, at version 2.1 or earlier. This is not an unauthenticated, default-configuration attack.

The provided CVSS 3.1 score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network reach but high attack complexity and a requirement for at least low-level privileges (PR:L, i.e., an authenticated account). The full C:H/I:H/A:H impact triad reflects that LFI can lead to secret disclosure and, under the right conditions, code execution. No EPSS score, KEV entry, or SSVC decision data was supplied, and no proof-of-concept is referenced, so real-world exploitation pressure appears low-to-moderate rather than urgent. Note a tension in the signals: the vendor tags this as 'Information Disclosure / LFI' (pointing to confidentiality), yet the CVSS vector asserts full Integrity and Availability impact - treat the I:H/A:H claim as contingent on chainable conditions (log poisoning, uploadable content, or writable includes) rather than guaranteed. The AC:H and PR:L metrics meaningfully lower practical risk versus an unauthenticated, low-complexity flaw.

An attacker who holds a low-privileged authenticated WordPress account sends a crafted request to a SetSail theme endpoint, supplying a manipulated file/path parameter with traversal sequences to make PHP include a local file such as wp-config.php, disclosing database credentials and secret keys. If the server allows it, the attacker chains the LFI with log poisoning or a PHP wrapper to achieve code execution. No public proof-of-concept is referenced, and the high attack complexity (AC:H) suggests non-trivial preconditions must be met.