{"id":"CVE-2026-48194","published":"2026-10-10T20:16:38.030","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/dukamarket/vulnerability/wordpress-dukamarket-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"DukaMarket v1.3.0 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files on the server. This flaw can lead to sensitive data exposure, including configuration files, database credentials, and application source code.","exploitability":"Exploitation requires no authentication and is relatively straightforward with a single HTTP request, though it may require knowledge of file paths or specific file types to maximize impact.","blast_radius":"If exploited, this vulnerability could expose sensitive server files including database credentials, configuration settings, and application source code, potentially leading to full system compromise.","remediation":"Upgrade to DukaMarket version 1.3.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","unauthenticated","file-inclusion"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:06.383Z"}}