The vulnerability identified as CVE-2026-57791 affects the ThemeMove Brook PHP theme. It involves improper control of the filename parameter used in PHP include or require statements, which can lead to local file inclusion (LFI). This flaw allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files on the affected system. The issue affects Brook versions up to 2.9.0. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, high complexity, low privileges required, and no user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system. An attacker may be able to include and execute arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the vulnerable theme or applying manual code review and hardening to prevent unsafe file inclusion. Monitor vendor channels for updates.