CVE-2026-62020
Received Received - Intake

Unauthenticated Local File Inclusion in TouchUp

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-11
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-62020
EUVD
EUVD-2026-96459

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mikado-Themes TouchUp n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Local File Inclusion (LFI) vulnerability in the TouchUp WordPress theme versions below 1.4. It allows attackers to include server files that should not be accessible without authentication, potentially leading to a full site takeover.

Detection Guidance

Check if the TouchUp theme version is below 1.4 by inspecting WordPress admin panel or running: grep -r 'TouchUp' /path/to/wordpress/wp-content/themes/. Detect unusual file inclusions by monitoring server logs for suspicious requests like /wp-content/themes/touchup/ or /wp-admin/admin-ajax.php?action=.

Use vulnerability scanners like WPScan with: wpscan --url http://target-site.com --enumerate vp,vt. Look for CVE-2026-62020 in scan results.

Impact Analysis

An attacker could exploit this to access sensitive files on the server, leading to unauthorized data exposure, system compromise, or complete site takeover. The high CVSS score of 8.1 indicates significant risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate data protection and access controls.

Mitigation Strategies

Update the TouchUp theme to version 1.4 or later immediately. If updating is not possible, apply the mitigation rule provided by Patchstack or disable the theme temporarily. Ensure all WordPress core, plugins, and themes are updated to their latest versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart