What is the CVSS score of EUVD-2026-57892?

EUVD-2026-57892 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Barista WordPress Theme are affected by EUVD-2026-57892?

The Barista WordPress theme (edge-themes) versions 2.5.1 and earlier contains a local file inclusion vulnerability (CVE-2026-66653, CVSS 8.1) that allows unauthenticated remote attackers to access…

How to fix or mitigate EUVD-2026-57892?

Within 24 hours, audit all WordPress installations to identify those running Barista theme (edge-themes) version 2.5.1 or earlier and classify by business criticality. Within 7 days, implement compensating controls including Web Application Firewall rules to block HTTP requests with directory traversal patterns, configure restrictive file system permissions to limit scope of potential file access, and apply input validation rules. Within 30 days, establish monitoring for vendor security updates, evaluate alternative WordPress themes for critical installations, and document incident response procedures for suspected exploitation.

Barista WordPress Theme EUVD-2026-57892

| CVE-2026-66653 HIGH

PHP Remote File Inclusion (CWE-98)

2026-08-13 Patchstack

GHSA-23x3-w8rc-9vq7

PHP WordPress Information Disclosure LFI Barista Wordpress Theme Edge Themes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI warrants PR:N and AV:N; AC:H reflects that full RCE escalation from file inclusion requires specific server-side conditions beyond the initial read primitive.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:29 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

AnalysisAI

Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes a classic PHP Local File Inclusion flaw where user-supplied input is passed unsanitized to a PHP include() or require() call, enabling path traversal to arbitrary files on the server. The affected product is the Barista WordPress theme by the edge-themes vendor (CPE: cpe:2.3:a:edge-themes:barista:*:*:*:*:*:*:*:*), covering all releases up to and including version 2.5.1. In WordPress deployments, LFI vulnerabilities in themes are particularly sensitive because the web root typically contains wp-config.php (holding database credentials) and PHP session files, and servers with write-accessible log files can be leveraged for LFI-to-RCE escalation via log poisoning techniques.

RemediationAI

No exact patched version number is confirmed from the available intelligence - patch availability should be verified directly via the Patchstack advisory at https://patchstack.com/database/wordpress/theme/barista/vulnerability/wordpress-barista-theme-2-5-1-local-file-inclusion-vulnerability and the edge-themes official release channel before upgrading. As an immediate compensating control, sites unable to patch should consider switching to an alternative active theme to remove the vulnerable code path entirely, noting that this has operational impact if the site relies on Barista's design. Deploying a Web Application Firewall (WAF) with LFI/path-traversal rules (e.g., blocking patterns such as ../ or /etc/ in request parameters) can reduce exposure without downtime, though WAF bypass is possible with encoding variants. Restricting PHP's open_basedir directive to limit the file system paths accessible to PHP include calls is a server-level control that directly limits the blast radius of LFI exploitation. Ensure wp-config.php permissions are set to 400/440 to reduce the risk of credential disclosure even if LFI is triggered.