CVE-2026-57801: SetSail Theme Path Traversal Vulnerability

CVE-2026-57801 Overview

CVE-2026-57801 is a PHP Local File Inclusion (LFI) vulnerability affecting the Select-Themes SetSail WordPress theme through version 2.1. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Authenticated attackers can supply crafted file path input to load arbitrary local PHP files from the server. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress installation.

Critical Impact
An authenticated attacker can include arbitrary local PHP files, leading to code execution within the WordPress environment and full compromise of the site.

Affected Products

Select-Themes SetSail WordPress theme
All versions from initial release through 2.1
WordPress sites running the SetSail theme

Discovery Timeline

2026-07-13 - CVE-2026-57801 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57801

Vulnerability Analysis

The SetSail theme contains a PHP file inclusion routine that fails to validate or restrict the filename argument used inside include or require statements. An authenticated user with low privileges can influence this filename parameter and force the theme to include arbitrary .php files present on the underlying filesystem. Because included files execute in the context of the WordPress PHP process, an attacker can trigger execution of any PHP code reachable on disk, including uploaded content, log files, or session files. The vulnerability is exploitable over the network but requires high attack complexity and valid credentials. The EPSS probability is 0.496%.

Root Cause

The root cause is a missing allowlist or sanitization step on the filename passed to a PHP file inclusion function. User-supplied input reaches include, include_once, require, or require_once without normalization against directory traversal sequences (../), null bytes, or absolute paths, matching the [CWE-98] pattern of improper control of filename for include/require statements.

Attack Vector

Exploitation occurs remotely against the WordPress site over HTTP or HTTPS. The attacker authenticates with a low-privilege account, then submits a request to a vulnerable SetSail theme endpoint with a path parameter pointing to a target file. The PHP interpreter reads and executes the referenced file. Where an attacker can plant PHP content elsewhere on the filesystem, such as an uploads directory or a log file the attacker controls, this LFI becomes a reliable path to remote code execution.

// No verified public proof-of-concept is available.
// See the Patchstack advisory referenced below for technical detail.

Detection Methods for CVE-2026-57801

Indicators of Compromise

HTTP requests to SetSail theme URLs containing path traversal sequences such as ../, encoded variants %2e%2e%2f, or absolute paths in query parameters.
Unexpected inclusions of files outside the theme directory, including references to wp-config.php, /etc/passwd, or PHP session files.
New or modified PHP files inside wp-content/uploads/ immediately followed by requests referencing those files.
Web server error logs showing include() or require() failures on attacker-controlled paths.

Detection Strategies

Inspect access logs for parameters passed to SetSail theme scripts that contain filesystem path characters.
Correlate authenticated WordPress sessions with abnormal file inclusion patterns from the same source IP.
Deploy web application firewall rules that flag LFI signatures targeting WordPress theme endpoints.
File integrity monitoring on the WordPress document root to identify unauthorized PHP file writes.

Monitoring Recommendations

Enable PHP error logging and forward E_WARNING events for include/require to a central log platform.
Alert on any successful HTTP 200 response to SetSail endpoints when request parameters contain .. or %00.
Track new low-privilege WordPress account registrations followed by requests to theme-controlled endpoints.

How to Mitigate CVE-2026-57801

Immediate Actions Required

Identify all WordPress instances running the SetSail theme at version 2.1 or earlier and inventory their versions.
Restrict access to the WordPress admin area and any authenticated endpoints with IP allowlisting until a fix is applied.
Audit user accounts and remove any unexpected low-privilege accounts that could satisfy the authentication precondition.
Deploy WAF rules blocking path traversal patterns targeting SetSail theme URLs.

Patch Information

At the time of publication, no fixed version beyond 2.1 is referenced in the NVD entry. Review the Patchstack WordPress Vulnerability Report for the latest vendor guidance and upgrade availability.

Workarounds

Temporarily disable the SetSail theme and switch to a maintained theme until a patched version is confirmed.
Configure open_basedir in PHP to restrict file inclusion to the WordPress installation directory.
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to eliminate remote inclusion vectors.
Apply virtual patching through a web application firewall to block requests containing traversal sequences to SetSail endpoints.

bash

# php.ini hardening to reduce file inclusion risk
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"