CVE-2026-57743: RT-Theme 18 Extensions LFI Vulnerability

CVE-2026-57743 Overview

CVE-2026-57743 is a Local File Inclusion (LFI) vulnerability in the stmcan RT-Theme 18 Extensions (rt18-extensions) plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements, classified as [CWE-98]. Attackers can manipulate file path parameters to load arbitrary local files through vulnerable PHP include logic. The vulnerability affects all versions of RT-Theme 18 Extensions up to and including version 2.5. Successful exploitation can lead to sensitive information disclosure, code execution through log poisoning, or full site compromise depending on the server configuration.

Critical Impact
Unauthenticated attackers can include arbitrary local PHP files on the server, potentially achieving remote code execution and complete WordPress site takeover.

Affected Products

stmcan RT-Theme 18 Extensions plugin (rt18-extensions)
All versions from initial release through 2.5
WordPress installations using the affected plugin

Discovery Timeline

2026-07-13 - CVE CVE-2026-57743 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57743

Vulnerability Analysis

The vulnerability originates in how the rt18-extensions plugin handles user-controlled input passed to PHP file inclusion functions. When the plugin constructs file paths for include, include_once, require, or require_once statements, it fails to properly validate or sanitize the filename parameter. Attackers can inject path traversal sequences or absolute paths to reference files outside the intended directory scope. Because the attack vector is Network-based and requires no authentication or user interaction, remote adversaries can reach the vulnerable code path directly through HTTP requests.

Root Cause

The root cause is improper input validation on filename parameters used within dynamic PHP file inclusion calls, tracked under [CWE-98]. The plugin trusts client-supplied values without enforcing an allowlist of permitted files or canonicalizing the path against a restricted directory. This design flaw allows the PHP interpreter to load and execute unintended local files as PHP source code.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request containing a manipulated filename parameter to a vulnerable endpoint exposed by the plugin. The PHP engine then includes the referenced file, executing its contents in the WordPress process context. Attackers commonly chain LFI with log poisoning, session file inclusion, or PHP wrappers such as php://filter to escalate to remote code execution. The attack complexity is rated High, indicating specific preconditions such as knowledge of internal paths must be met for reliable exploitation.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Plugin Vulnerability advisory for additional technical detail.

Detection Methods for CVE-2026-57743

Indicators of Compromise

HTTP requests to WordPress endpoints containing path traversal sequences such as ../, ..%2f, or %2e%2e%2f in query parameters
Requests referencing sensitive server paths such as /etc/passwd, wp-config.php, or PHP session files
Use of PHP stream wrappers like php://filter, php://input, or data:// in request parameters targeting rt18-extensions
Unexpected PHP errors in web server logs referencing include() or require() failures inside plugin files

Detection Strategies

Deploy web application firewall rules that block path traversal patterns and PHP wrapper schemes in query strings and POST bodies
Monitor WordPress access logs for requests targeting wp-content/plugins/rt18-extensions/ with suspicious parameter values
Inspect PHP error logs for warnings referencing failed file inclusion within the plugin directory
Correlate anomalous outbound connections or process spawns from the web server user with preceding suspicious HTTP requests

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress hosts running the affected plugin
Alert on repeated 200 responses to requests containing traversal sequences, which may indicate successful file reads
Track file integrity for wp-config.php and other sensitive files that may be targeted for disclosure
Monitor web server processes for unexpected child process creation following inbound HTTP traffic

How to Mitigate CVE-2026-57743

Immediate Actions Required

Identify all WordPress installations running the rt18-extensions plugin at version 2.5 or earlier
Disable or remove the plugin until a patched version becomes available from the vendor
Restrict access to WordPress admin and plugin endpoints using IP allowlisting where feasible
Review web server and PHP logs for evidence of prior exploitation attempts

Patch Information

At the time of publication, the vendor advisory indicates the vulnerability affects versions up to and including 2.5. Administrators should consult the Patchstack advisory for the latest patch status and upgrade guidance.

Workarounds

Deactivate the rt18-extensions plugin from the WordPress admin console until a fixed release is confirmed
Configure PHP with allow_url_include=Off and restrict open_basedir to limit file inclusion scope
Deploy WAF signatures that block path traversal, PHP wrapper schemes, and known LFI payloads
Enforce least-privilege file permissions on the WordPress document root and sensitive configuration files

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = /var/www/html:/tmp
disable_functions = exec,passthru,shell_exec,system,proc_open,popen