{"id":"CVE-2026-42724","published":"2026-10-10T20:16:37.390","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/cleanskin/vulnerability/wordpress-cleanskin-theme-1-5-0-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in CleanSkin versions 1.5.0 and earlier allows unauthenticated local file inclusion, enabling attackers to read arbitrary files on the server filesystem. This represents a high-severity risk as it can lead to data exposure, system compromise, and potential lateral movement within the affected environment.","exploitability":"Exploitation requires no authentication and is relatively straightforward, with attackers able to craft malicious requests to include local files through vulnerable parameters, though specific file paths may need to be discovered or guessed.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive configuration files, database credentials, application source code, and potentially enable further compromise of the entire web application stack.","remediation":"Upgrade to CleanSkin version 1.5.1 or later to address this local file inclusion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","file-inclusion","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:22.897Z"}}