{"id":"CVE-2026-62066","published":"2026-10-10T20:16:41.130","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Volos <= 1.2 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/volos-wp/vulnerability/wordpress-volos-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Volos versions 1.2 and earlier allows unauthenticated local file inclusion, enabling attackers to read arbitrary files on the server. This is particularly dangerous because it can lead to sensitive data exposure or further system compromise.","exploitability":"Exploitation is moderately difficult due to the need for a specific parameter injection point, but requires no authentication and can be performed remotely.","blast_radius":"The impact could be significant as attackers may access configuration files, database credentials, or application source code, potentially leading to full system compromise.","remediation":"Upgrade to Volos version 1.3 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","file-inclusion","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:08:48.239Z"}}