{"id":"CVE-2026-62075","published":"2026-10-10T20:16:41.880","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/backhoe/vulnerability/wordpress-backhoe-theme-2-0-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Backhoe application suffers from an unauthenticated Local File Inclusion (LFI) vulnerability that allows attackers to read arbitrary files from the server's filesystem without any authentication. This flaw is particularly dangerous because it can be exploited remotely without needing valid credentials, potentially exposing sensitive configuration files, database credentials, and application source code.","exploitability":"Exploitation requires sending a crafted request to the vulnerable endpoint with a malicious file path parameter, but no authentication or user interaction is needed, making it relatively easy to exploit with minimal preconditions.","blast_radius":"If exploited, this vulnerability could lead to exposure of sensitive application files, database credentials, and potentially allow attackers to execute arbitrary code on the server, affecting all users and data within the application's scope.","remediation":"Upgrade to Backhoe version 2.1 or later to address this LFI vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","unauthenticated","web","file-inclusion"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:08:15.675Z"}}