CVE-2026-48194

Received Received - Intake

Unauthenticated Local File Inclusion in DukaMarket

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-48194

EUVD

EUVD-2026-96458

Affected Vendors & Products

Vendor	Product	Version / Range
kutethemes	DukaMarket	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

CVE-2026-48194 is an unauthenticated Local File Inclusion (LFI) vulnerability in the DukaMarket WordPress theme versions 1.3.0 and below. It allows attackers to include unauthorized server files, potentially leading to a site takeover.

Detection Guidance

Check for unauthorized file inclusions in web server logs, particularly for requests containing suspicious file paths or parameters. Monitor for unusual server responses or errors indicating file access outside intended directories.

Impact Analysis

This vulnerability can allow attackers to access sensitive files on the server, leading to complete site compromise. Since it is unauthenticated, attackers do not need prior access to exploit it, increasing the risk of mass attacks.

Mitigation Strategies

Apply the mitigation rule provided by Patchstack to block attacks. Temporarily disable the DukaMarket theme if possible. Contact your hosting provider or developer for assistance. Avoid using the theme until an official patch is released.

Hi! I’m here to help you understand CVE-2026-48194. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70