The vulnerability CVE-2026-57796 affects VLThemes Leedo versions up to 3.0.0 and is characterized by improper control of filenames in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited to execute arbitrary code or disclose sensitive information by including unintended local files. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code on the affected system. The CVSS score indicates high impact on confidentiality, integrity, and availability. This could result in full system compromise depending on the server configuration and the files accessible via the inclusion flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP settings, or employing web application firewalls to detect and block exploitation attempts.