What is the CVSS score of EUVD-2026-43421?

EUVD-2026-43421 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Tonda Theme are affected by EUVD-2026-43421?

The Select-Themes 'Tonda' WordPress theme (all versions through 2.5) contains a local file inclusion vulnerability requiring authenticated access that allows low-privilege users to expose sensitive…

How to fix or mitigate EUVD-2026-43421?

Within 24 hours, inventory all WordPress installations across your infrastructure to identify any deployment of the Tonda theme through version 2.5 and document systems requiring immediate remediation. Within 7 days, remove the affected theme from all production environments; if replacement is not immediately feasible, apply filesystem-level hardening by restricting read access to wp-config.php, .env files, and sensitive log directories to only the web server process, deploy WAF rules to block directory traversal and arbitrary file inclusion patterns, and audit user permissions to revoke publishing capabilities from non-administrative accounts. Within 30 days, deploy a vetted replacement theme, establish ongoing monitoring of WordPress security advisories and Patchstack vulnerability feeds for any future Tonda theme patches, and complete a privileged access review to ensure user capability assignments align with business roles.

Tonda Theme EUVD-2026-43421

| CVE-2026-57805 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Tonda

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Authenticated theme LFI (PR:L) reachable remotely but requiring specific conditions (AC:H); primary impact is file disclosure (C:H), with limited integrity via potential poisoning (I:L) and no direct availability impact (A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:26 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Tonda commercial WordPress theme (CPE cpe:2.3:a:select-themes:tonda). The root cause is CWE-98, Improper Control of Filename for Include/Require Statement ('PHP Remote/Local File Inclusion'): a PHP include(), require(), include_once() or require_once() call builds its path from attacker-influenceable input (commonly a theme template, layout, or shortcode parameter) without a strict allowlist or path sanitization. Because WordPress themes execute within the full CMS context, an included file is parsed and run as PHP by the web server, meaning any file the PHP process can read may be exposed and, if attacker-controlled content can be written into an includable file, executed.

RemediationAI

No vendor-released patch version is identified at time of analysis; the input only confirms all versions up to and including 2.5 are affected, so monitor Select-Themes/Patchstack (https://patchstack.com/database/Wordpress/Theme/tonda/vulnerability/wordpress-tonda-theme-2-5-local-file-inclusion-vulnerability) and upgrade to the first release above 2.5 once published. Until a fix is available, apply compensating controls: use a WordPress WAF/virtual patch (Patchstack offers one) to block file-inclusion payloads and directory-traversal sequences against theme endpoints; tighten access by disabling open user registration and enforcing least-privilege roles since exploitation requires an authenticated account; and harden PHP by setting open_basedir and allow_url_include=Off to constrain which files the theme can include - noting open_basedir can break plugins that legitimately access paths outside the web root. If the theme is not essential, switch to a maintained theme as the most durable mitigation.