What is the CVSS score of EUVD-2026-43417?

EUVD-2026-43417 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of SetSail are affected by EUVD-2026-43417?

The Select-Themes SetSail WordPress theme (versions 2.1 and earlier) contains a local file inclusion vulnerability allowing authenticated attackers to access sensitive configuration files such as…

How to fix or mitigate EUVD-2026-43417?

Within 24 hours: Audit all WordPress installations to identify Select-Themes SetSail theme version 2.1 or earlier and document affected sites. Within 7 days: Disable or remove the vulnerable theme from all production environments; implement restrictive file permissions (chmod 600) on wp-config.php and other sensitive configuration files; deploy web application firewall (WAF) rules to block requests targeting theme include paths; contact the vendor for patch timeline. Within 30 days: Migrate affected sites to an actively-maintained alternative WordPress theme, or maintain compensating controls if theme replacement is not operationally feasible.

SetSail EUVD-2026-43417

| CVE-2026-57801 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Setsail

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network-reachable but requires an authenticated low-priv account (PR:L) and non-trivial preconditions (AC:H); confidentiality high from file disclosure, but integrity/availability only low as code execution is conditional.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:28 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

SetSail is a commercial WordPress theme distributed by Select-Themes (CPE cpe:2.3:a:select-themes:setsail). The flaw is a classic CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-influenced input reaches a PHP include(), require(), include_once(), or require_once() call without adequate sanitization or an allowlist. Although CWE-98 is formally the 'PHP Remote File Inclusion' class, the vendor classifies the practical impact here as Local File Inclusion, meaning the attacker controls a path resolved on the local filesystem rather than a fully remote URL. Such theme-level LFI typically stems from a template/loader parameter (for example a 'page', 'file', or 'style' style argument) being concatenated into an include path, allowing directory traversal to arbitrary local PHP or configuration files.

RemediationAI

No fixed version number is provided in the available data, so no vendor-released patch version can be confirmed at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/setsail/vulnerability/wordpress-setsail-theme-2-1-local-file-inclusion-vulnerability?_s_id=cve) and Select-Themes for an update newer than 2.1 and upgrade as soon as one is published. Until a patched release is confirmed, apply compensating controls: deploy a WAF or Patchstack virtual patch to block directory-traversal sequences (../, php://, encoded null bytes) against the theme's include parameters; harden PHP by disabling allow_url_include and allow_url_fopen and setting an open_basedir restriction to confine includes to the web root (trade-off: may break plugins that rely on remote fetches or paths outside the root); and restrict or audit the authenticated accounts able to reach the vulnerable functionality, since PR:L means a valid low-privilege login is required. If the feature is non-essential, consider temporarily switching to an alternate theme.