Touchup
Monthly
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.