What is the CVSS score of EUVD-2026-43418?

EUVD-2026-43418 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Struktur (WordPress theme) are affected by EUVD-2026-43418?

Organizations using the Select-Themes Struktur WordPress theme (versions up to 2.5.1) face credential compromise through an authenticated local file inclusion vulnerability that exposes wp-config.php…

How to fix or mitigate EUVD-2026-43418?

Within 24 hours, audit all WordPress installations for Struktur theme versions 2.5.1 or earlier and document all user accounts with administrative or editor roles. Within 7 days, revoke or disable non-essential user accounts, restrict administrative access to a trusted subset, and implement file system monitoring on wp-config.php and configuration directories. Over the next 30 days, monitor Select-Themes security advisories for patch availability, evaluate migration to an alternative maintained theme, and establish incident response procedures including offline backup restoration capabilities for rapid recovery.

Struktur (WordPress theme) EUVD-2026-43418

| CVE-2026-57802 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Struktur

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Authenticated (PR:L) and high-complexity (AC:H) LFI tagged as information disclosure, so confidentiality-high with no confirmed integrity/availability impact absent a documented RCE path.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:28 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n/a through <= 2.5.1.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.

Technical ContextAI

The affected component is Struktur, a commercial WordPress theme published by Select-Themes (CPE cpe:2.3:a:select-themes:struktur:*). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), which occurs when a PHP include(), require(), include_once() or require_once() call incorporates attacker-influenced input into the file path without adequate sanitization or allow-listing. In WordPress themes this typically arises from a template/parameter-driven loader (e.g. a 'page', 'template', or 'file' request parameter) that is concatenated into an include path, allowing traversal to unintended local files. Although CWE-98 formally covers Remote File Inclusion, Patchstack classifies this specific issue as Local File Inclusion, meaning the attacker references files already present on the server rather than a remote URL.

RemediationAI

No vendor-released patch version is identified in the available data (the advisory lists impact only 'through <= 2.5.1' without naming a fixed release), so the primary action is to check Select-Themes / ThemeForest and the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/struktur/vulnerability/wordpress-struktur-theme-2-5-1-local-file-inclusion-vulnerability-2) for an update newer than 2.5.1 and apply it once released. Until a fix is confirmed, apply compensating controls: deploy a WAF or Patchstack's virtual patch to block traversal sequences and suspicious file/template parameters in requests to the theme; restrict or remove low-privilege self-registration so untrusted users cannot obtain the authenticated access the exploit requires (trade-off: affects legitimate account signup); harden PHP by disabling allow_url_include and setting open_basedir to confine include() to the web root (trade-off: may break plugins relying on external paths); and tighten filesystem permissions on wp-config.php and other sensitive files. Because the theme itself is the vulnerable code, disabling/switching away from Struktur eliminates exposure at the cost of the site's active theme.