{"id":"CVE-2026-42704","published":"2026-10-10T20:16:35.797","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/kidscare/vulnerability/wordpress-kids-care-theme-3-2-4-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Kids Care application suffers from an unauthenticated Local File Inclusion (LFI) vulnerability that allows attackers to read arbitrary files from the server's filesystem without any authentication. This flaw is particularly dangerous because it can lead to sensitive data exposure, including configuration files, database credentials, and potentially remote code execution through file inclusion.","exploitability":"Exploitation requires sending a crafted request to the vulnerable endpoint with a malicious file path parameter, but no authentication is needed, making it relatively easy to exploit with minimal preconditions.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive application data, configuration files, and potentially database credentials, leading to further compromise of the affected system and its users.","remediation":"Upgrade to Kids Care version 3.2.5 or later to address this LFI vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","local-file-inclusion","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:28.926Z"}}