CVE-2026-57789

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

The Aqua WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. This affects versions up to and including 5.1.2.

Risk Assessment

An attacker can read sensitive server files (e.g., /etc/passwd) or execute malicious code, potentially leading to full site compromise.

Recommendation

Immediately update the Aqua plugin to the latest available version. If an update is not possible, consider temporarily disabling the plugin.

Other vulnerabilities in Aqua

CVE-2026-55569Medium
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.