{"id":"CVE-2026-62020","published":"2026-10-10T20:16:38.380","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/touchup/vulnerability/wordpress-touchup-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote attacker can include arbitrary local files through a vulnerable parameter in TouchUp versions before 1.4, allowing them to read sensitive files and potentially execute code.","exploitability":"Exploitation requires no authentication and is relatively straightforward with a single vulnerable parameter, though the exact impact depends on which files are accessible to the web server process.","blast_radius":"The vulnerability could allow attackers to read configuration files, database credentials, and potentially execute arbitrary code on the affected system, leading to full compromise of the TouchUp application and underlying server.","remediation":"Upgrade to TouchUp version 1.4 or later to remediate this local file inclusion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","unauthenticated","local-file-inclusion"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:09:00.668Z"}}