The vulnerability CVE-2026-57793 in Elated-Themes Flow arises from improper validation or control of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can allow an attacker to include and execute unintended files on the server. The affected versions include all versions up to and including 1.8. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to arbitrary code execution or disclosure of sensitive information by including unintended local files. The impact affects confidentiality, integrity, and availability of the affected system. The attack requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable endpoints and validate or sanitize inputs controlling file inclusion paths to mitigate risk.