CVE-2026-57802

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

43th percentile - higher than 43% of all known CVEs

Summary

A vulnerability in the Struktur theme by Select-Themes allows PHP Local File Inclusion due to improper control of filename for include/require statement. This affects versions before 2.7.

Risk Assessment

An attacker could exploit this to read sensitive files on the server or execute malicious code, potentially compromising confidentiality and integrity of the application.

Recommendation

Update the Struktur theme to version 2.7 or later. Additionally, secure the application against local file inclusion by validating user input.

Other vulnerabilities in Struktur

CVE-2025-69029Medium
The Struktur plugin (struktur) contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.5.1.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS