{"id":"CVE-2026-62115","published":"2026-10-10T20:16:43.813","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/kuteshop/vulnerability/wordpress-kuteshop-theme-4-2-9-local-file-inclusion-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"CVE-2026-62115 is an unauthenticated Local File Inclusion (LFI) vulnerability in KuteShop versions up to 4.2.9, allowing attackers to read arbitrary files on the server without authentication. This flaw can lead to sensitive data exposure, including configuration files, database credentials, and potentially remote code execution through file inclusion.","exploitability":"Exploitation is moderately difficult due to the need for a specific parameter injection point, but requires no authentication and can be executed remotely with a single HTTP request.","blast_radius":"The impact could be significant in environments where KuteShop is deployed, potentially exposing sensitive configuration files, database credentials, and application source code that could lead to further compromise of the affected system.","remediation":"Upgrade to KuteShop version 4.3.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","web","file-inclusion","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:07:47.603Z"}}