What is the CVSS score of EUVD-2026-43415?

EUVD-2026-43415 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Nuss Theme are affected by EUVD-2026-43415?

The uxper Nuss WordPress theme (versions 1.3.6 and earlier) contains a local file inclusion vulnerability allowing authenticated users to access sensitive server files and potentially execute…

How to fix or mitigate EUVD-2026-43415?

Within 24 hours, inventory all WordPress installations using uxper Nuss theme version 1.3.6 or earlier, prioritizing systems handling customer data or sensitive operations. Within 7 days, implement compensating controls: enforce strong authentication requirements, disable user self-registration, and deploy Web Application Firewall rules to detect and block file inclusion patterns (path traversal sequences, suspicious include/require functions). Within 30 days, plan theme replacement or upgrade to a patched version once available from the vendor; subscribe to Patchstack and WordPress security bulletins for patch availability, and evaluate architectural hardening (separate application/data servers, reduced web process privileges) to limit blast radius of similar vulnerabilities.

Nuss Theme EUVD-2026-43415

| CVE-2026-57799 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Nuss

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable but requires a low-privilege authenticated account (PR:L) and non-trivial conditions to steer the include path (AC:H); local file inclusion can reach code execution, giving high C/I/A.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:29 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.

AnalysisAI

Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.

Technical ContextAI

The affected component is Nuss, a commercial WordPress theme published by uxper, running as PHP inside a WordPress installation (CPE cpe:2.3:a:uxper:nuss:*). The root cause is CWE-98, 'Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion)', where a filename or path used in a PHP include/require statement is derived from attacker-influenced input without sufficient validation or allow-listing. Patchstack classifies the realizable impact here as Local File Inclusion, meaning the include path resolves to files already present on the host (theme parameters, page/template selectors, or similar) rather than a remote URL, so an attacker steers execution toward unintended local PHP files. WordPress themes commonly implement dynamic template loading, and when that logic passes user-supplied values into include/require it becomes exploitable.

RemediationAI

No vendor-released patch identified at time of analysis; the record states affected 'from n/a through <= 1.3.6' without naming a fixed release, so administrators should check the vendor/ThemeForest changelog and the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/nuss/vulnerability/wordpress-nuss-theme-1-3-6-local-file-inclusion-vulnerability) for a version newer than 1.3.6 and upgrade once one is published. Until a patched version is confirmed, apply compensating controls: use a WordPress virtual-patching/WAF layer (Patchstack offers one) to block requests carrying suspicious include/path parameters; tighten account controls by removing or restricting low-privilege accounts such as subscribers and contributors, since exploitation requires authentication - this shrinks the attacker pool at the cost of open self-registration; set PHP open_basedir and disable allow_url_include/allow_url_fopen to constrain what can be included, which may break plugins relying on remote fetches; and monitor web/access logs for anomalous parameter values referencing local paths. If the affected functionality is not needed, consider switching to a maintained theme.