CVE-2026-62070

Received Received - Intake

Unauthenticated Local File Inclusion in Flipmart

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-62070

EUVD

EUVD-2026-96485

Affected Vendors & Products

Vendor	Product	Version / Range
CKThemes	Flipmart	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

CVE-2026-62070 is an unauthenticated Local File Inclusion (LFI) vulnerability in Flipmart WordPress theme versions 2.8 and below. It allows attackers to include unauthorized server files, potentially leading to site takeover.

Detection Guidance

Check if your Flipmart theme version is 2.8 or below by inspecting the theme files or WordPress admin panel. Monitor server logs for unusual file inclusion requests or access patterns that may indicate exploitation attempts.

Impact Analysis

This vulnerability can allow attackers to access sensitive files on the server, leading to complete site compromise. It may result in data theft, malware injection, or unauthorized administrative access.

Mitigation Strategies

Apply Patchstack's mitigation rule if available, or contact your hosting provider for assistance. Avoid using the vulnerable theme versions until an official patch is released. Consider temporarily switching to a different theme if possible.

Hi! I’m here to help you understand CVE-2026-62070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70