CVE-2026-57788 Edge-Themes CVE debrief

Who should care

Users of Edge-Themes Aalto aalto plugin for WordPress, security teams, and operators of affected systems should be aware of this HIGH severity vulnerability rated at 7.5 CVSS score. They should verify installed Aalto plugin versions, apply vendor patches or upgrades if available, and implement compensating controls like web application firewalls.

Technical summary

CVE-2026-57788 is a PHP Local File Inclusion vulnerability in Edge-Themes Aalto aalto, affecting versions from n/a through <= 1.8. The vulnerability is caused by Improper Control of Filename for Include/Require Statement in PHP Program, also known as PHP Remote File Inclusion. This vulnerability has a HIGH CVSS severity score of 7.5.

Defensive priority

High priority for users of affected Aalto versions due to HIGH CVSS severity score of 7.5. Immediate attention is required to verify installed plugin versions, apply patches, and implement compensating controls.

Recommended defensive actions

• Inventory and verify installed Aalto plugin versions
• Apply vendor patches or upgrades if available
• Implement compensating controls like web application firewalls
• Monitor for suspicious file inclusion attempts
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate a HIGH severity vulnerability in Aalto plugin versions up to 1.8. Further details are needed for comprehensive risk assessment. Defenders should verify affected scope, severity, and vendor guidance through official advisory or CVE record review.

Official resources