{"id":"CVE-2026-42777","published":"2026-10-10T20:16:37.533","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/aalto/vulnerability/wordpress-aalto-theme-1-8-local-file-inclusion-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Aalto versions 1.8 and earlier contain a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files on the server. This flaw can lead to sensitive data exposure and potentially full system compromise.","exploitability":"Exploitation requires sending a crafted request to the vulnerable endpoint, with no authentication required but needing to know the target file path structure.","blast_radius":"If exploited, this vulnerability could expose sensitive configuration files, database credentials, and application source code, potentially leading to complete system compromise.","remediation":"Upgrade to version 1.9 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","file-inclusion","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:17.038Z"}}