CVE-2026-57799: Nuss Path Traversal Vulnerability

CVE-2026-57799 Overview

CVE-2026-57799 is a PHP Local File Inclusion (LFI) vulnerability in the uxper Nuss WordPress theme. The flaw affects all versions of Nuss from unspecified initial releases through version 1.3.6. The vulnerability stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. An authenticated attacker with low privileges can manipulate file path parameters to force the theme to include arbitrary local PHP files. Successful exploitation can lead to code execution, sensitive information disclosure, and full compromise of the WordPress installation.

Critical Impact
Authenticated attackers can include arbitrary local PHP files on the server, potentially leading to remote code execution and complete site compromise.

Affected Products

uxper Nuss WordPress theme versions up to and including 1.3.6
WordPress installations that have the Nuss theme active
Multisite WordPress environments where Nuss is available on network sites

Discovery Timeline

2026-07-13 - CVE-2026-57799 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57799

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion issue in the Nuss theme. The theme accepts user-influenced input and passes it to a PHP include or require statement without sufficient validation or allow-list enforcement. Although the CVE title references PHP Remote File Inclusion, the confirmed exploitation vector is local file inclusion. Attackers supply a crafted path parameter that resolves to a file on the server the web process can read. When that file is a PHP source file, the interpreter executes its contents in the context of the current request. This behavior allows adversaries to reach code paths never intended to be exposed through the theme.

Root Cause

The root cause is improper control of the filename argument passed to a PHP file inclusion function [CWE-98]. The theme does not restrict inputs to a fixed allow-list, does not normalize path traversal sequences, and does not verify that the resolved path resides in an expected directory. Any request parameter, cookie, or option value that influences the include target inherits the privileges of the PHP worker process.

Attack Vector

Exploitation occurs over the network against the WordPress front end or admin interface. The attacker must hold a valid low-privilege account, such as a subscriber or contributor, to reach the vulnerable code path. The attacker submits a request containing a manipulated path parameter that references a local PHP file. If the file exists and is readable, its contents execute in the WordPress context. Chained with log poisoning, session file manipulation, or uploaded media that contains PHP payloads, the LFI can be escalated to arbitrary code execution.

No verified public proof-of-concept code is available. For technical details, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2026-57799

Indicators of Compromise

HTTP requests to Nuss theme endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd and /proc/self/environ
Unexpected PHP execution originating from theme files in wp-content/themes/nuss/
New or modified PHP files in wp-content/uploads/ timestamped near suspicious request activity
Access log entries showing low-privilege users triggering theme parameters that resolve to system paths

Detection Strategies

Inspect web server access logs for query parameters targeting Nuss theme scripts with file-like values or encoded traversal characters
Monitor PHP error logs for include() or require() warnings referencing unexpected paths
Correlate authenticated WordPress sessions with abnormal file access patterns from the PHP worker process
Apply file integrity monitoring to the WordPress installation, focusing on theme, plugin, and upload directories

Monitoring Recommendations

Enable verbose logging on the WordPress installation and forward logs to a centralized analytics platform
Alert on any process spawned by the PHP-FPM or Apache worker that executes shell interpreters such as /bin/sh, bash, or python
Track outbound connections from web servers to unfamiliar destinations, which may indicate post-exploitation staging

How to Mitigate CVE-2026-57799

Immediate Actions Required

Update the Nuss theme to a version later than 1.3.6 once the vendor releases a patched release
Restrict registration and demote or remove low-privilege accounts that are not strictly required
Deploy a web application firewall rule that blocks path traversal patterns and absolute path parameters against Nuss theme endpoints
Audit wp-content/uploads/ and theme directories for unauthorized PHP files and remove any that are not part of a known good baseline

Patch Information

At the time of publication, refer to the Patchstack WordPress Vulnerability Report for the latest fixed version and vendor guidance. Apply the vendor-supplied update as soon as it is available and verify the theme version through the WordPress admin dashboard after upgrade.

Workarounds

Deactivate the Nuss theme and switch to a maintained alternative until a patched version is installed
Configure PHP with open_basedir restrictions to limit which directories the interpreter can read
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to reduce inclusion-related attack surface
Enforce least privilege on the web server user so that sensitive system files are not readable by the PHP process

bash

# Example php.ini hardening to limit file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"