TouchUp WordPress Theme EUVD-2026-96459

Exploitation targets WordPress installations running the Mikado Themes 'TouchUp' theme at versions below 1.4; the flaw is reachable by remote unauthenticated attackers (PR:N, UI:N) through a file-inclusion parameter handled by the theme's PHP code. The CVSS AC:H rating indicates exploitation is NOT guaranteed against all defaults - it likely depends on specific request conditions, server configuration, or path constraints, which is the primary factor limiting opportunistic mass exploitation. Scope is further limited to sites that have this particular theme installed and active, a small population relative to WordPress as a whole.

Signals are mixed and lean toward moderate real-world priority rather than an emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, which raises its theoretical reach, but the AC:H flag indicates exploitation is not trivial and likely depends on specific conditions or timing, tempering the 8.1 base score. No EPSS probability was provided in the input, the vulnerability is NOT listed in CISA KEV, and no public exploit code (POC) is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is also a signal conflict worth flagging: the CVSS vector claims full I:H and A:H impact, but the description and tags characterize this strictly as an 'Information Disclosure' Local File Inclusion, which typically yields confidentiality loss (file read) rather than integrity/availability compromise - verify with Patchstack whether the LFI escalates to code execution (CWE-98 covers PHP file inclusion that can lead to RCE), because that single question determines whether this is a disclosure bug or a full compromise. Net: a genuine but not top-tier priority given the niche affected product and absence of exploitation evidence; patch during a normal cycle unless the product is internet-facing.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the TouchUp theme (< 1.4), abusing an unsanitized file/path parameter to force the PHP application to include a server-local file. This exposes sensitive files such as wp-config.php (database credentials, salts) or other configuration data; if attacker-controlled content can be reached by the include, it may escalate to code execution. No public exploit code is referenced, and the CVSS AC:H rating implies non-trivial conditions must be met for reliable exploitation.