CVE-2026-57800: Overworld Path Traversal Vulnerability

CVE-2026-57800 Overview

CVE-2026-57800 is a Local File Inclusion (LFI) vulnerability affecting the Edge-Themes Overworld WordPress theme through version 1.5. The flaw stems from improper control of a filename used in a PHP include or require statement [CWE-98]. Authenticated attackers can manipulate file path parameters to load arbitrary local PHP files on the server. Successful exploitation can lead to sensitive information disclosure, code execution via log poisoning, and full compromise of the WordPress installation. The vulnerability is tracked under the CWE-98 category covering PHP Remote File Inclusion and its local variant.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure and potential remote code execution on affected WordPress sites.

Affected Products

Edge-Themes Overworld WordPress Theme versions up to and including 1.5
WordPress installations using the vulnerable Overworld theme
Any hosting environment running the affected theme code

Discovery Timeline

2026-07-13 - CVE-2026-57800 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57800

Vulnerability Analysis

The Overworld theme accepts user-supplied input that is passed to a PHP include or require statement without sufficient validation or sanitization. This allows an attacker to control which file the PHP interpreter loads and executes. The attack vector is network-based and requires low privileges, meaning an authenticated user role is sufficient to trigger the vulnerable code path.

Because include and require execute PHP code from the included file, an LFI can escalate beyond simple file disclosure. Attackers commonly chain LFI with log poisoning, session file manipulation, or php:// wrappers to achieve arbitrary code execution.

Root Cause

The root cause is improper control of the filename parameter passed to a PHP file inclusion function. The theme fails to enforce an allowlist of permitted files or apply canonicalization that would block directory traversal sequences such as ../. When the input reaches include or require, PHP resolves the path relative to the include path and executes any matching file as PHP code.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the Overworld theme, supplying a manipulated filename parameter. The parameter typically references paths outside the theme directory using traversal sequences or absolute paths. The PHP interpreter then loads the referenced file, executing it in the context of the web server user. Common exploitation targets include WordPress wp-config.php, system files such as /etc/passwd, and poisoned log files that contain attacker-injected PHP payloads.

See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-57800

Indicators of Compromise

HTTP requests to Overworld theme endpoints containing directory traversal sequences such as ../ or encoded variants like %2e%2e%2f
Requests referencing sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ in query parameters
Use of PHP stream wrappers like php://filter or php://input within request parameters targeting the theme
Unexpected inclusion of log files (access.log, error.log) via theme URLs, indicating potential log poisoning attempts

Detection Strategies

Deploy web application firewall rules that inspect query strings and POST bodies for path traversal patterns and PHP wrapper schemes
Correlate authenticated WordPress sessions with anomalous requests to theme files that reference filesystem paths
Monitor PHP error logs for include or require warnings referencing unexpected file paths

Monitoring Recommendations

Enable verbose access logging on the WordPress web server and forward logs to a centralized analytics platform
Alert on any request whose parameters contain filesystem traversal tokens or absolute paths beginning with /
Track file access patterns of the PHP-FPM or Apache worker process for reads outside the WordPress document root

How to Mitigate CVE-2026-57800

Immediate Actions Required

Disable or remove the Edge-Themes Overworld theme on any WordPress installation running version 1.5 or earlier until a fixed release is available
Restrict access to WordPress authentication endpoints and audit all accounts with contributor-level access or higher
Apply web application firewall rules that block path traversal and PHP wrapper payloads targeting theme URLs

Patch Information

At the time of publication, no vendor patch is referenced in the advisory. Consult the Patchstack WordPress Vulnerability Report for the current fix status and any updated versions released by Edge-Themes.

Workarounds

Set the PHP open_basedir directive to restrict file access to the WordPress installation directory
Disable dangerous PHP stream wrappers by configuring allow_url_include=Off and allow_url_fopen=Off in php.ini
Replace the Overworld theme with an alternative theme until a patched version is confirmed
Enforce least-privilege file permissions on wp-config.php and other sensitive files to limit disclosure impact

bash

# Configuration example: harden php.ini against LFI exploitation
allow_url_include = Off
allow_url_fopen = Off
open_basedir = /var/www/html:/tmp
disable_functions = exec,passthru,shell_exec,system,proc_open,popen