CVE-2026-57805

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

43th percentile - higher than 43% of all known CVEs

Summary

The Tonda WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.5.

Risk Assessment

An attacker can read sensitive server files (e.g., configuration, passwords) or execute malicious code, potentially leading to full site compromise.

Recommendation

Immediately update the Tonda plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Tonda

CVE-2026-28151High
Unauthenticated Local File Inclusion in Tonda versions prior to 2.6.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS