{"id":"CVE-2026-66566","published":"2026-10-10T20:16:46.103","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/ambient/vulnerability/wordpress-ambient-theme-1-7-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Ambient allows unauthenticated local file inclusion (LFI) in versions up to 1.7, enabling attackers to read arbitrary files on the server and potentially execute code.","exploitability":"Exploitation requires sending a crafted request to the vulnerable endpoint without authentication, with minimal preconditions beyond network access to the application.","blast_radius":"If exploited, this vulnerability could allow attackers to read sensitive configuration files, database credentials, or source code, leading to potential full system compromise.","remediation":"Upgrade to Ambient version 1.8 or later to remediate this LFI vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","local-file-inclusion","unauthenticated","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:07:41.359Z"}}