The vulnerability CVE-2026-57789 affects jwsthemes Aqua versions up to and including 5.1.2. It arises from improper control over the filename used in PHP include or require statements, which leads to a Local File Inclusion (LFI) vulnerability. This flaw allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files on the affected system. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, enabling attackers to read sensitive files, execute arbitrary code, or disrupt system availability. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability. Since the vulnerability allows remote network-based attacks with low privileges and no user interaction, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying strict input validation or sanitization if possible, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks where possible.