CVE-2026-57791: ThemeMove Brook LFI Vulnerability

CVE-2026-57791 Overview

CVE-2026-57791 is a PHP Local File Inclusion (LFI) vulnerability affecting the ThemeMove Brook WordPress theme through version 2.9.0. The flaw stems from improper control of filename parameters used in PHP include or require statements, classified under [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files on the server. Successful exploitation can lead to disclosure of sensitive files, execution of attacker-controlled code, and full compromise of the WordPress site.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to sensitive information disclosure and potential remote code execution on affected WordPress installations.

Affected Products

ThemeMove Brook WordPress theme versions up to and including 2.9.0
WordPress installations using the Brook theme without applied patches
Any hosting environment running vulnerable Brook theme instances

Discovery Timeline

2026-07-13 - CVE-2026-57791 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57791

Vulnerability Analysis

The vulnerability resides in how the Brook theme handles filename input passed to PHP include or require statements. The theme accepts user-controllable input and uses it to construct a file path without adequate sanitization or allowlist enforcement. This flaw is categorized as [CWE-98] Improper Control of Filename for Include/Require Statement in PHP Program.

Because the attack originates over the network and requires only low-privileged authentication, any authenticated user role that can reach the vulnerable code path may exploit the issue. Attackers can traverse the filesystem using sequences such as ../ to reference files outside the intended directory. When PHP interprets the referenced file, any PHP code inside it executes with the privileges of the web server.

The current EPSS data indicates a probability of 0.496% with a percentile of 39.36, reflecting limited observed exploitation activity at publication time.

Root Cause

The root cause is missing validation on filename input passed to a dynamic file inclusion statement. The Brook theme trusts request parameters to identify template or module files and passes them directly to include/require. Without a strict allowlist or path canonicalization, the theme cannot distinguish legitimate template names from attacker-controlled paths.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to a Brook theme endpoint that references a manipulated filename parameter. The parameter points to a local file such as a configuration file, log file, or uploaded payload. PHP then includes and executes the referenced file within the WordPress request context. See the Patchstack WordPress Theme Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-57791

Indicators of Compromise

HTTP requests to Brook theme endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Access log entries showing filename parameters referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP execution originating from uploaded files in wp-content/uploads directories

Detection Strategies

Inspect web server access logs for query parameters containing filesystem paths, null bytes, or traversal sequences targeting theme files under wp-content/themes/brook/
Deploy Web Application Firewall (WAF) rules to flag inclusion patterns and LFI payloads sent to WordPress theme endpoints
Monitor PHP error logs for include() or require() warnings referencing unexpected file paths

Monitoring Recommendations

Alert on authenticated WordPress sessions issuing requests with abnormal file path parameters
Track file access patterns targeting wp-config.php and other configuration files from the web server process
Correlate low-privilege user activity with unusual outbound connections or process spawns from the PHP interpreter

How to Mitigate CVE-2026-57791

Immediate Actions Required

Identify all WordPress instances running the ThemeMove Brook theme at version 2.9.0 or earlier
Restrict access to WordPress authentication endpoints and audit low-privilege user accounts for suspicious activity
Review wp-content/themes/brook/ and uploads directories for unauthorized PHP files that could be targeted via inclusion

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-57791. Administrators should consult the Patchstack advisory for vendor updates and apply any released patches immediately once available.

Workarounds

Disable or replace the Brook theme until a vendor-supplied fix is available
Deploy WAF rules that block requests containing path traversal sequences and filesystem paths in query parameters targeting theme endpoints
Enforce PHP open_basedir restrictions to constrain file inclusion to the WordPress installation directory
Set PHP allow_url_include to Off and validate that allow_url_fopen is disabled where not required

bash

# Example php.ini hardening to reduce LFI/RFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"