CVE-2026-62074

Deferred Deferred - Pending Action

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-11

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62074

EUVD

EUVD-2026-96486

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	Ozeum	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

CVE-2026-62074 is an unauthenticated Local File Inclusion (LFI) vulnerability in the Ozeum WordPress theme versions 1.3.0 and below. It allows attackers to include server files that should not be accessible without authentication, potentially leading to a website takeover.

Detection Guidance

Check for unauthorized file inclusion attempts in server logs, particularly for requests to theme files in Ozeum <= 1.3.0. Look for patterns like path traversal sequences (../) or unusual file extensions in URLs.

Impact Analysis

This vulnerability can allow attackers to access sensitive files on the server, leading to complete website compromise. Attackers could steal data, deface the site, or use it as a foothold for further attacks. The high CVSS score of 8.1 indicates a significant risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Apply Patchstack's temporary mitigation rule if available. Disable or remove the Ozeum theme if not in use. Contact your hosting provider for assistance. Monitor for suspicious activity and restrict file access permissions.

Hi! I’m here to help you understand CVE-2026-62074. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70