The vulnerability CVE-2026-57790 in ThemeMove Billey arises from improper control of the filename parameter in PHP include/require statements, resulting in a PHP Local File Inclusion (LFI) vulnerability. This can allow an attacker to include and execute local files on the server, potentially leading to remote code execution or information disclosure. The vulnerability affects versions up to and including 2.1.8. The CVSS 3.1 base score is 7.5, reflecting high impact with network attack vector, high confidentiality, integrity, and availability impacts, but requiring high attack complexity and low privileges without user interaction. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The attacker can leverage the local file inclusion to execute arbitrary code or escalate privileges, severely impacting system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users only, and consider applying web application firewall rules to detect and block suspicious include/require parameter usage. Monitor for updates from ThemeMove regarding patches or official mitigations.