CVE-2026-57803: Struktur Core Path Traversal Vulnerability

CVE-2026-57803 Overview

CVE-2026-57803 is a PHP Local File Inclusion (LFI) vulnerability in the Select-Themes Struktur Core plugin for WordPress. The flaw affects all versions of struktur-core up to and including 2.5.1. It stems from improper control of a filename used in a PHP include or require statement [CWE-98]. An authenticated attacker with low privileges can supply a crafted filename value to include arbitrary local files on the server. Successful exploitation exposes sensitive configuration data and can lead to code execution when includable content is attacker-controlled.

Critical Impact
Attackers with low-privileged accounts can include arbitrary PHP files on the host, exposing credentials in wp-config.php and enabling code execution paths that compromise the entire WordPress site.

Affected Products

Select-Themes Struktur Core plugin for WordPress
Struktur Core versions from initial release through 2.5.1
WordPress installations using the struktur-core component

Discovery Timeline

2026-07-13 - CVE-2026-57803 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57803

Vulnerability Analysis

The Struktur Core plugin passes user-influenced input into a PHP include or require construct without adequate sanitization. This class of flaw, categorized as PHP File Inclusion [CWE-98], permits attackers to reference arbitrary paths on the local filesystem. Files interpreted by the PHP engine execute in the context of the web server user. Non-executable files, such as .env or wp-config.php, are read and returned in the response body when included as text. The advisory from Patchstack confirms exploitability against Struktur Core versions up to 2.5.1.

Root Cause

The underlying weakness is missing validation of a filename parameter passed to a file inclusion sink. The plugin does not enforce an allowlist of expected template names, does not restrict the base directory, and does not strip traversal sequences such as ../. Any request handler that accepts the parameter forwards it directly to PHP's file loading logic, causing the interpreter to resolve and load the attacker-supplied path.

Attack Vector

Exploitation occurs over the network against a WordPress site running the vulnerable plugin. The attacker must hold at least a low-privileged authenticated session, which lowers the barrier significantly on sites that permit subscriber or contributor registration. The attacker submits a request to the vulnerable endpoint containing a filename value that resolves outside the intended template directory. See the Patchstack Vulnerability Report for the technical breakdown.

No verified public proof-of-concept code is available. The vulnerability manifests when a request parameter reaches a PHP include/require call in the plugin. Refer to the vendor advisory for reproduction details.

Detection Methods for CVE-2026-57803

Indicators of Compromise

HTTP requests to struktur-core endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths beginning with /
Web server access logs showing successful 200 responses to plugin URLs with unusual file, template, or path parameters
Outbound reads or references to sensitive files including wp-config.php, /etc/passwd, or PHP session files
Newly created PHP files in wp-content/uploads/ that are subsequently loaded through the plugin

Detection Strategies

Inspect WordPress access logs for requests to Struktur Core handlers containing filesystem paths or encoded traversal patterns
Deploy a Web Application Firewall (WAF) rule that blocks parameters containing ../ or null bytes when directed at the plugin
Correlate authenticated low-privilege sessions with anomalous parameter values on plugin endpoints
Alert when PHP processes read files outside the WordPress installation root during plugin request handling

Monitoring Recommendations

Enable audit logging on the WordPress installation and forward events to a centralized SIEM
Monitor file integrity on wp-config.php, plugin directories, and wp-content/uploads/
Track subscriber and contributor account creation rates for signs of automated registration
Review outbound network traffic from the web server for unexpected connections that may follow post-exploitation activity

How to Mitigate CVE-2026-57803

Immediate Actions Required

Update the Struktur Core plugin to a version released after 2.5.1 once the vendor publishes a fix
Disable the struktur-core plugin until a patched version is available if the site permits self-registration
Rotate WordPress secret keys, database credentials, and any API tokens stored in wp-config.php
Audit user accounts and remove unrecognized low-privileged users

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack indicates the issue affects Struktur Core through 2.5.1. Administrators should consult the Patchstack Vulnerability Report and the Select-Themes vendor pages for the fixed release version and apply it across all affected WordPress instances.

Workarounds

Deactivate the Struktur Core plugin until a patched build is installed
Restrict registration on the WordPress site to trusted users to reduce the pool of accounts that meet the low-privilege prerequisite
Deploy WAF rules that block traversal sequences and absolute paths in query parameters and POST bodies targeted at plugin endpoints
Set the PHP open_basedir directive to constrain the filesystem paths accessible to the web server process

bash

# Constrain PHP file access to the WordPress root using open_basedir
# Add to php.ini or a per-vhost configuration
open_basedir = "/var/www/html/:/tmp/"

# Optional: disable functions commonly abused after LFI
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"