CVE-2026-48193

Received Received - Intake

Unauthenticated Local File Inclusion in Uminex

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-48193

EUVD

EUVD-2026-96457

Affected Vendors & Products

Vendor	Product	Version / Range
kutethemes	Uminex	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

This vulnerability is an Unauthenticated Local File Inclusion (LFI) in the Uminex WordPress theme versions 1.0.9 and below. It allows attackers to include unauthorized server files without authentication, potentially leading to a complete site takeover.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file inclusion attempts in web server logs. Check for suspicious GET or POST requests targeting common LFI paths like /wp-content/themes/uminex/ or /wp-admin/admin-ajax.php with parameters such as ?file= or ?template=. Use tools like grep to search logs for these patterns.

Impact Analysis

Attackers could exploit this to access sensitive files on your server, steal data, or take control of your website. Since it is unauthenticated, anyone can attempt to exploit it remotely.

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attack attempts. If possible, update the Uminex theme to a patched version. If no update is available, contact your hosting provider or web developer for assistance. Disable the theme if unused or replace it with a secure alternative.

Hi! I’m here to help you understand CVE-2026-48193. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70