CVE-2026-42704

Received Received - Intake

Unauthenticated Local File Inclusion in Kids Care

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-42704

EUVD

EUVD-2026-96441

Affected Vendors & Products

Vendor	Product	Version / Range
axiomthemes	Kids	Care n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

CVE-2026-42704 is an Unauthenticated Local File Inclusion (LFI) vulnerability in the Kids Care WordPress theme versions 3.2.4 and below. It allows unauthenticated attackers to include unauthorized server files, potentially leading to site takeover.

Detection Guidance

Check if your Kids Care theme version is 3.2.4 or below. Look for suspicious file inclusion attempts in server logs or web application firewall alerts. No specific commands are provided in the context.

Impact Analysis

This vulnerability can allow attackers to access sensitive files on the server, leading to complete site compromise. It is actively exploited in mass campaigns, affecting all websites using vulnerable versions regardless of size or popularity.

Mitigation Strategies

Apply Patchstack's mitigation rule to block attacks. Update the Kids Care theme to the latest version if available. Contact your hosting provider or developer for assistance if no patch exists. Monitor for unauthorized file inclusion attempts.

Hi! I’m here to help you understand CVE-2026-42704. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70