{"id":"CVE-2026-48193","published":"2026-10-10T20:16:37.903","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/uminex/vulnerability/wordpress-uminex-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Uminex application suffers from an unauthenticated Local File Inclusion vulnerability that allows attackers to read arbitrary files from the server's filesystem without needing any credentials. This flaw can lead to sensitive data exposure and potentially full system compromise.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and only needs to send a crafted request to the vulnerable endpoint, though the attacker must know or guess file paths on the target system.","blast_radius":"If exploited, this vulnerability could result in widespread exposure of sensitive application files, configuration data, and potentially database credentials, leading to unauthorized access to backend systems and user data.","remediation":"Upgrade to Uminex version 1.0.10 or later to address this Local File Inclusion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","file-read","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:12.075Z"}}