{"id":"CVE-2026-62065","published":"2026-10-10T20:16:41.010","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/cardea-wp/vulnerability/wordpress-cardea-theme-2-3-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Cardea application suffers from an unauthenticated Local File Inclusion vulnerability that allows attackers to read arbitrary files from the server's filesystem without needing any credentials. This flaw is particularly dangerous because it can lead to sensitive data exposure, including configuration files, database credentials, and potentially system files.","exploitability":"Exploitation requires no authentication and involves sending a crafted request to include local files, making it relatively easy to exploit with minimal preconditions.","blast_radius":"If exploited, this vulnerability could expose sensitive application configuration files, database connection details, and potentially allow attackers to read system files that could lead to further compromise of the affected server.","remediation":"Upgrade to version 2.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","local-file-inclusion","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:08:53.795Z"}}