What is the CVSS score of CVE-2026-57803?

CVE-2026-57803 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Struktur Core are affected by CVE-2026-57803?

The Select-Themes Struktur Core WordPress plugin (versions up to 2.5.1) contains a local file inclusion vulnerability enabling authenticated users to extract sensitive database credentials and…

How to fix or mitigate CVE-2026-57803?

Within 24 hours, audit all WordPress installations to identify any using Select-Themes Struktur Core plugin version 2.5.1 or earlier, and restrict plugin access to administrative accounts only. Within 7 days, either disable the plugin entirely or migrate to an alternative theme provider, and review server logs for suspicious file access attempts via theme parameters. Within 30 days, implement database credential rotation for all affected systems, ensure wp-config.php file permissions follow least-privilege principles, and conduct a full security assessment of any systems that may have been compromised during the vulnerability window.

Struktur Core CVE-2026-57803

EUVD-2026-43419 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Struktur Core

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Authenticated low-priv user (PR:L) triggers an LFI with non-trivial preconditions (AC:H); confirmed impact is file disclosure (C:H), while integrity/availability are N absent verified code execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:27 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core struktur-core allows PHP Local File Inclusion.This issue affects Struktur Core: from n/a through <= 2.5.1.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

Local File Inclusion in the Select-Themes Struktur Core WordPress plugin (all versions up to and including 2.5.1) lets an authenticated low-privileged user coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive server-side content such as wp-config.php credentials. Reported by Patchstack and classified under CWE-98 (PHP Remote File Inclusion), the flaw carries a CVSS 3.1 score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Depending on server configuration, LFI of attacker-influenced content (e.g., poisoned logs or uploaded files) can escalate to PHP code execution.

Technical ContextAI

The vulnerability stems from improper control of a filename passed to a PHP include/require statement (CWE-98) within the Struktur Core plugin, a helper/core plugin distributed by Select-Themes for their WordPress themes. When a user-controllable value is concatenated into an include path without allow-list validation, PHP will resolve and execute/read the referenced path. Although CWE-98 is formally 'PHP Remote File Inclusion,' Patchstack's assessment and tags scope the practical impact to Local File Inclusion, meaning the attacker can traverse to and include files already present on the server. The single affected CPE is cpe:2.3:a:select-themes:struktur_core:*, confirming the plugin (not the parent theme) as the vulnerable component.

RemediationAI

No vendor-released patch identified at time of analysis - the input specifies affected versions up to and including 2.5.1 but names no fixed release, so monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/struktur-core/vulnerability/wordpress-struktur-core-plugin-2-5-1-local-file-inclusion-vulnerability) and the Select-Themes changelog for a version above 2.5.1 and upgrade as soon as it is published. Until then, apply compensating controls: deploy a WAF or Patchstack virtual patch to block LFI/path-traversal payloads (sequences like ../ and null bytes) targeting the plugin's endpoints; tighten user registration and role assignment so untrusted users cannot obtain the low-privilege account the exploit requires (side effect: may block legitimate self-registration workflows); and harden PHP with open_basedir and disabled allow_url_include/allow_url_fopen to constrain which files an include can reach (side effect: can break plugins that legitimately read files outside the web root). If the plugin is not essential, deactivating and removing it eliminates the exposure entirely.