CVE-2026-57790

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

43th percentile - higher than 43% of all known CVEs

Summary

The Billey WordPress plugin is vulnerable to Local File Inclusion (LFI) due to improper control of filename in include/require statements. The vulnerability affects versions up to and including 2.1.8.

Risk Assessment

An attacker can read sensitive files on the server (e.g., /etc/passwd, configuration files) or potentially execute malicious code, leading to confidentiality and integrity breaches.

Recommendation

Immediately update the Billey plugin to the latest available version. If an update is not possible, consider temporarily disabling the plugin until a patch is released.

Other vulnerabilities in Billey

CVE-2025-59558High
The Billey theme by ThemeMove has a PHP Local File Inclusion vulnerability due to improper filename control in include/require statements. Affects versions up to 2.1.6 (exclusive).

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS