DukaMarket CVE-2026-48194

Requires a WordPress site with the DukaMarket theme (kutethemes) version 1.3.0 or earlier installed and active, with the vulnerable file-inclusion parameter reachable over the network. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N). The High attack complexity (AC:H) is the key limiting factor: successful exploitation depends on conditions not fully under the attacker's control - likely a specific encoding, path-traversal filter bypass, or server/configuration state (e.g., particular PHP settings) - rather than a single trivially repeatable request. Realistic impact is bounded to sites actually running this theme, a relatively small population.

Signals are moderate and partly conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, which raises priority, but the High attack complexity (AC:H) tempers it - successful exploitation depends on conditions outside the attacker's full control rather than being a trivial one-shot request. The 8.1 base score is driven heavily by the input's C:H/I:H/A:H impact triad, yet the vulnerability is described and tagged as 'Information Disclosure' / LFI (CWE-98), which in practice most directly affects confidentiality; the full High integrity and availability impact is not substantiated by the description and should be verified. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. Net assessment: a credible but not emergency-grade issue - unauthenticated and remotely reachable favors patching, while AC:H, limited product footprint, and absence of exploitation evidence argue against treating it as actively weaponized. Note the impact-metric disagreement explicitly: input claims I:H/A:H but an LFI/information-disclosure flaw typically yields confidentiality impact only - verify with Patchstack/vendor before assuming full compromise.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the DukaMarket theme (<=1.3.0), manipulating a parameter that is passed into a PHP include/require path. By satisfying the specific conditions implied by the High attack complexity, the attacker causes the application to load and disclose the contents of local files such as wp-config.php or other sensitive server files. No public exploit code was identified at time of analysis.