CVE-2026-57788

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

The Aalto WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper filename control in include/require statements. This affects all versions up to and including 1.8.

Risk Assessment

An attacker can read sensitive server files (e.g., /etc/passwd, configuration files) or execute arbitrary code, potentially leading to full site compromise.

Recommendation

Immediately update the Aalto plugin to the latest available version (above 1.8) or remove it if not essential.

Other vulnerabilities in Aalto

CVE-2026-42777High
Unauthenticated Local File Inclusion in Aalto versions up to 1.8.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS