CVE-2026-57791

Name of the Vulnerable Software and Affected Versions ThemeMove Brook versions prior to 2.9.1

Description ThemeMove Brook allows Local File Inclusion, a condition where an application includes a file without properly validating the input, potentially allowing the execution of arbitrary PHP code. Authenticated attackers with contributor-level access and above can include and execute arbitrary files on the server. This can be used to bypass access controls or obtain sensitive data, especially when images or other safe file types are uploaded and subsequently included.

Recommendations Update ThemeMove Brook to a version newer than 2.9.0.