Description
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Published: 2026-10-10
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion (Information Disclosure)
Action: Patch
AI Analysis

Impact

Unauthenticated Local File Inclusion (CWE-98) exists in the Kids Care WordPress theme versions 3.2.4 and older. The flaw allows an attacker to request any file located on the web server by manipulating a URL parameter. This can lead to unauthorized reading of arbitrary files, including configuration files, credentials or other sensitive data. The description does not confirm the ability to execute PHP code, so remote code execution is not supported by the available information.

Affected Systems

WordPress installations that use the Kids Care theme from Axiom Themes, version 3.2.4 or earlier, are affected. The theme can be deployed as the active appearance theme or any other theme that is enabled.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity risk. No EPSS score is available, but the issue is unauthenticated and can be triggered with a simple HTTP request, suggesting a relatively high likelihood of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog. An attacker can craft path‑traversal strings or their encoded equivalents in the request to read sensitive files from the server.

Generated by OpenCVE AI on October 10, 2026 at 22:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest available update from Axiom Themes to the Kids Care theme, ensuring the vulnerable file‑inclusion logic is removed.
  • If an immediate update is not feasible, deactivate the Kids Care theme or switch to a different theme to block unauthenticated access to the vulnerable code.
  • Deploy a web application firewall rule or server configuration that rejects requests containing path‑traversal patterns such as "../" or URL‑encoded equivalents until the theme is updated.

Generated by OpenCVE AI on October 10, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Title WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:53:08.769Z

Reserved: 2026-04-29T09:05:07.701Z

Link: CVE-2026-42704

cve-icon Vulnrichment

Updated: 2026-10-11T11:44:33.363Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:35.797

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-42704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T23:00:16Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')