CVE-2026-57794

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

The Golo Framework WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 1.7.3.

Risk Assessment

An attacker can read sensitive server files (e.g., configuration files) or execute arbitrary PHP code, potentially leading to full compromise of the WordPress site.

Recommendation

Immediately update the Golo Framework plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.

Other vulnerabilities in Golo Framework

CVE-2026-28150High
Unauthenticated Local File Inclusion in Golo Framework versions prior to 1.7.5.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3.