CVE-2026-57799
Received Received - Intake

PHP Local File Inclusion in Nuss

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-57799
EUVD
EUVD-2026-43415

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uxper nuss From 1.0 (inc) to 1.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is a Local File Inclusion (LFI) issue in the WordPress Nuss Theme, versions 1.3.6 and below. It allows attackers to include and display local files from the target website by improperly controlling the filename used in PHP include or require statements.

This means an attacker with contributor-level privileges can exploit this flaw to access sensitive files on the server, such as configuration files or database credentials, if the server configuration permits.

The vulnerability is classified under OWASP Top 10 A3: Injection and has a CVSS v3.1 base score of 7.5, indicating a high severity impact.

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized access to sensitive local files on the web server hosting the vulnerable WordPress Nuss Theme.

This can expose critical information such as database credentials, configuration files, or other sensitive data, potentially leading to further compromise of the website or server.

Because the vulnerability requires contributor-level privileges, an attacker who has gained such access can leverage this flaw to escalate their impact.

The vulnerability is often exploited in mass campaigns targeting many websites, increasing the risk of widespread impact.

Mitigation Strategies

The WordPress Nuss Theme versions 1.3.6 and below are affected by a Local File Inclusion vulnerability.

Users are advised to update the theme immediately to a version above 1.3.6 if available.

If no official patch is available, seek assistance from your hosting provider or web developer to apply mitigations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart