CVE-2026-57792: Dør Theme Path Traversal Vulnerability

CVE-2026-57792 Overview

CVE-2026-57792 is a Local File Inclusion (LFI) vulnerability affecting the Mikado-Themes Dør WordPress theme through version 2.4.1. The flaw stems from improper control of a filename used in a PHP include or require statement, classified under [CWE-98]. An authenticated attacker with low privileges can coerce the theme into including arbitrary local PHP files. Successful exploitation exposes sensitive configuration data and can lead to code execution on the underlying host.

Critical Impact
Attackers with low-privilege access can include arbitrary local PHP files, resulting in disclosure of sensitive data and potential remote code execution on affected WordPress sites.

Affected Products

Mikado-Themes Dør WordPress theme, all versions up to and including 2.4.1
WordPress installations using the Dør theme for site rendering
Hosting environments where the theme has write or read access to sensitive local files

Discovery Timeline

2026-07-13 - CVE-2026-57792 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57792

Vulnerability Analysis

The Dør theme accepts attacker-influenced input that flows into a PHP file inclusion statement without sufficient validation. This behavior maps to [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. Although the advisory title references PHP Remote File Inclusion, the confirmed impact is Local File Inclusion (LFI). An authenticated user can request paths that resolve to sensitive PHP or configuration files on the web server. The current EPSS probability is 0.496% at the 39.363 percentile, indicating moderate near-term exploitation likelihood.

Root Cause

The vulnerability originates from concatenating user-controllable input directly into an include, include_once, require, or require_once call. The theme lacks an allow-list of permitted template names and does not normalize or restrict path traversal sequences such as ../. This allows a request parameter to override the intended file target.

Attack Vector

Exploitation requires network access and low-privilege authentication to the WordPress site. The attacker submits a crafted request that supplies an alternate filename to a vulnerable theme endpoint. The PHP interpreter then loads and executes the referenced file within the WordPress request context. Chaining LFI with log poisoning or writable session files can escalate the impact to remote code execution. See the Patchstack WordPress Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-57792

Indicators of Compromise

HTTP requests to Dør theme PHP endpoints containing traversal sequences such as ../ or absolute paths like /etc/passwd and wp-config.php.
Unexpected include/require failures in PHP error logs referencing theme files under wp-content/themes/dor/.
Web server access logs showing repeated 200 responses to theme URLs with unusual query parameters supplying file paths.
Outbound network connections from the PHP-FPM or Apache process originating shortly after suspicious theme requests.

Detection Strategies

Deploy WAF rules that block traversal patterns and null-byte injection against wp-content/themes/dor/ request paths.
Enable PHP open_basedir restrictions and monitor for violations, which indicate attempted inclusion outside the web root.
Correlate authentication events with theme file requests to identify low-privilege accounts probing inclusion endpoints.

Monitoring Recommendations

Alert on any HTTP parameter values containing ../, php://, file://, or references to wp-config.php.
Monitor file integrity of wp-content/themes/dor/ and adjacent theme directories for unauthorized changes.
Track PHP error log entries citing include() or require() failures targeting non-standard paths.

How to Mitigate CVE-2026-57792

Immediate Actions Required

Deactivate the Dør theme on any WordPress site running version 2.4.1 or earlier until a vendor patch is applied.
Restrict authenticated access to trusted users and audit existing low-privilege accounts for unexpected activity.
Apply virtual patching at the WAF layer to block LFI payloads targeting the Dør theme.

Patch Information

No fixed version is listed in the advisory at time of publication. Consult the Patchstack WordPress Vulnerability Advisory for updates, and upgrade to a version above 2.4.1 when released by Mikado-Themes.

Workarounds

Configure PHP open_basedir to confine file access to the WordPress installation directory only.
Disable allow_url_include and allow_url_fopen in php.ini to reduce inclusion abuse vectors.
Use file system permissions to make wp-config.php and log files unreadable by the web server user where feasible.

bash

# Configuration example: harden php.ini against file inclusion abuse
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"