Tonda
Monthly
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.