Aalto theme: Unauthenticated local file inclusion
Summary
The Aalto theme for WordPress by Edge-Themes, version 1.8 and earlier, contains a local file inclusion flaw. An unauthenticated remote attacker can make the website load server files it should not access, which can expose sensitive data and may lead to a takeover depending on the server setup. No login or user interaction is required, but attack complexity is rated high. Sites running this theme on the internet are the main exposure.
Affected
- Aalto WordPress theme by Edge-Themes, version 1.8 and earlier (<= 1.8)
Fixed in
Unknown. No fixed version has been published by the vendor at the time of research.
Workaround
- No vendor workaround known.
- Patchstack reports a mitigation rule for attacks on this issue. Availability for this CVE is not confirmed.
Exploitation
- No evidence of exploitation in the wild found. Patchstack expects exploitation, but this is not confirmed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: unknown.
- EPSS about 0.003 (low).
Our recommendation
- Check all WordPress sites for the Aalto theme, including inactive themes in the theme folder, and record the exact version.
- If Aalto is installed and no fix is available, switch to a maintained theme.
- Restrict access to administration and file upload areas, and keep WordPress core and PHP up to date.
- Use a web application firewall with virtual patching if available.
- Monitor the Patchstack entry and Edge-Themes for a fix.
- Verify whether CVE-2026-57788 is a duplicate of this record before reporting.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Aalto theme <= 1.8 Local File Inclusion patchstack.com
- OpenCVE: CVE-2026-42777 app.opencve.io
- Vulners: CVE-2026-42777 vulners.com
- Vulners: Patchstack advisory for CVE-2026-42777 vulners.com
- HOL Guard: CVE-2026-42777 hol.org
- HOL Guard: CVE-2026-57788 (possible duplicate) hol.org
- ThreatInt: CVE-2026-42777 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:12.
Original description (NVD)
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.