Unauthenticated Local File Inclusion in CleanSkin

Executive Summary

CVE-2026-42724 is an Unauthenticated Local File Inclusion (LFI) vulnerability in the CleanSkin WordPress theme versions up to 1.5.0. This means attackers can include unauthorized server files without authentication, potentially leading to full site takeover. The flaw has a high CVSS score of 8.1 and is classified under OWASP Top 10 A3: Injection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your CleanSkin theme version is 1.5.0 or below. Look for unusual file inclusion attempts in server logs, such as paths containing '..' or common sensitive files like /etc/passwd. Use commands like grep to search logs for suspicious patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive server files, leading to complete site compromise. Attackers could steal data, inject malicious code, or deface the website. Since no privileges are required, any unpatched CleanSkin theme version 1.5.0 or below is at high risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements. A successful exploit may result in data breaches, triggering legal penalties, fines, and reputational damage for organizations handling protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply Patchstack's mitigation rule if available. If no patch exists, consider disabling the CleanSkin theme or replacing it with a secure alternative. Contact your hosting provider for assistance. Monitor for exploitation attempts in logs.

Useful 0 Not Useful 0