CVE-2026-57793: Flow Theme PHP File Inclusion Vulnerability

CVE-2026-57793 Overview

CVE-2026-57793 is a Local File Inclusion (LFI) vulnerability in the Elated-Themes Flow WordPress theme. The flaw stems from improper control of the filename used in PHP include or require statements [CWE-98]. Authenticated attackers can leverage this weakness to load arbitrary local PHP files through the affected theme. The vulnerability affects Flow theme versions up to and including 1.8. Successful exploitation impacts the confidentiality, integrity, and availability of the underlying WordPress installation.

Critical Impact
An authenticated attacker can include arbitrary local PHP files on the server, enabling code execution paths, sensitive file disclosure, and potential full compromise of the WordPress site.

Affected Products

Elated-Themes Flow WordPress Theme (versions through 1.8)
WordPress installations using the Flow theme as an active or included template
Sites bundling Flow theme components in child themes or staging environments

Discovery Timeline

2026-07-13 - CVE-2026-57793 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57793

Vulnerability Analysis

The Flow theme fails to properly validate or sanitize input passed into PHP file-inclusion functions such as include, include_once, require, or require_once. When user-controlled input reaches these functions without allow-list validation, an attacker can direct the interpreter to load files outside the intended scope. This behavior maps to Common Weakness Enumeration [CWE-98], covering improper control of filenames used in include or require statements.

In the WordPress context, this LFI condition allows attackers to disclose configuration files such as wp-config.php, application logs, or session data. If the target environment permits log poisoning, session file writes, or upload of PHP-parsable content, the LFI can escalate into remote code execution. The attack requires low privileges but higher attack complexity, based on the CVSS vector.

Root Cause

The root cause is untrusted input flowing directly into a PHP file-inclusion sink without normalization, path canonicalization, or allow-list enforcement. The theme accepts a filename parameter and concatenates it into an include path. Because PHP resolves relative paths and traversal sequences, attackers can supply crafted values to reach arbitrary files readable by the web server process.

Attack Vector

Exploitation occurs over the network against a vulnerable WordPress endpoint exposed by the Flow theme. The attacker authenticates with a low-privilege account and submits a crafted request containing a manipulated filename parameter. The vulnerable code path then loads the attacker-specified file. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57793

Indicators of Compromise

Web server access logs showing requests to Flow theme PHP files containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f.
Unexpected inclusion of sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ referenced in query strings.
Requests supplying php://filter or php://input wrappers targeting Flow theme endpoints.
New or modified PHP files in wp-content/uploads/ following suspicious requests.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag path traversal and PHP wrapper patterns in requests to WordPress theme directories.
Enable PHP open_basedir logging to capture inclusion attempts outside expected directories.
Correlate authenticated WordPress sessions with abnormal parameter values referencing filesystem paths.

Monitoring Recommendations

Monitor WordPress audit logs for privilege changes and file modifications in the theme directory.
Alert on outbound connections from the PHP-FPM or Apache worker processes to atypical destinations.
Track file integrity on wp-config.php, wp-content/themes/flow/, and PHP session storage directories.

How to Mitigate CVE-2026-57793

Immediate Actions Required

Identify all WordPress sites running the Elated-Themes Flow theme at version 1.8 or earlier.
Restrict access to WordPress administrative and authenticated endpoints via IP allow-listing or VPN.
Rotate WordPress credentials, salts, and any secrets stored in wp-config.php if exploitation is suspected.

Patch Information

At the time of publication, the vendor advisory does not list a fixed version. Consult the Patchstack WordPress Vulnerability Report for the latest remediation status and apply any released Flow theme update above version 1.8 once available.

Workarounds

Deactivate and remove the Flow theme until a patched version is released.
Deploy WAF signatures blocking path traversal, null byte injection, and PHP stream wrappers in requests targeting theme files.
Configure PHP open_basedir and disable_functions to constrain file inclusion scope and dangerous functions.
Set filesystem permissions so the web server user cannot read sensitive configuration files outside the WordPress webroot.

bash

# Configuration example: harden PHP against LFI exploitation
# /etc/php/8.2/fpm/conf.d/99-hardening.ini
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"