Kids Care EUVD-2026-96441

The description specifies no explicit configuration prerequisite beyond running the Kids Care WordPress theme at version 3.2.4 or earlier; exploitation targets an unsanitized file-inclusion parameter and requires no authentication (PR:N) and no user interaction (UI:N). The principal LIMITING factor is the vendor-assigned High Attack Complexity (AC:H): a specific, non-trivial precondition or multi-step maneuver is required for reliable exploitation, though the available data does not name that precise condition (the exact vulnerable endpoint/parameter is not disclosed). Realistic impact is bounded by the attacker's inability to upload content in a classic LFI, so disclosure of readable local files (e.g., wp-config.php) is the most likely outcome unless a log-poisoning or wrapper technique enables escalation.

Signals are mixed and point to a credible but not top-tier priority. The CVSS 3.1 base score of 8.1 (High) reflects a network-reachable (AV:N), unauthenticated (PR:N), no-interaction (UI:N) flaw with full C/I/A impact, which on its face looks severe; however, the vendor-assigned High Attack Complexity (AC:H) is the key dampener, indicating a non-trivial precondition or specialized step is needed to succeed rather than trivial drive-by exploitation. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The CVE is NOT in CISA KEV (no active-exploitation signal) and no POC/exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data (automatable, technical impact) was provided. The C:H/I:H/A:H impact rating appears generous for a vulnerability the vendor tags as 'Information Disclosure / LFI' - pure local file inclusion is typically confidentiality-dominant, so the I:H/A:H components should be verified with Patchstack/the vendor. Net: a legitimately exploitable unauthenticated flaw worth patching, but the AC:H gate plus the absence of KEV/POC/EPSS suggests it is not currently under mass exploitation and ranks below trivially-exploitable AC:L internet-facing bugs.

A remote, unauthenticated attacker crafts a request to a vulnerable endpoint of a WordPress site running the Kids Care theme (<= 3.2.4) and abuses an unsanitized file-path parameter to force the PHP application to include a local file, disclosing sensitive content such as wp-config.php (database credentials, auth keys). The High attack complexity (AC:H) means success depends on a specific precondition or non-trivial step rather than a single trivial request. No public exploit code is referenced at time of analysis.