Kids Care WordPress theme: Local File Inclusion without authentication
Summary
The Kids Care WordPress theme up to and including version 3.2.4 contains an unauthenticated Local File Inclusion flaw (CWE-98). A remote attacker can make the web server load local files that should not be accessible, which may expose sensitive data and, in the worst case, lead to a takeover of the site. Exploitation requires no login, but the attack complexity is rated high. Patchstack rates the issue as high priority and expects exploitation, while CISA's scoring currently shows no known exploitation.
Affected
- Kids Care WordPress theme by AxiomThemes, versions up to and including 3.2.4
Fixed in
- Unknown. No vendor advisory naming a fixed version was found.
Workaround
- No vendor-published workaround known.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available (requires a Patchstack subscription).
Exploitation
- Known exploited: no (per the sources reviewed).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Public proof of concept: none found in the research; this does not prove none exists.
- Patchstack rates the vulnerability as high priority and expects exploitation.
Our recommendation
- Check whether the Kids Care theme is installed on any website, including inactive themes.
- If it is installed and unused, remove it.
- If it is in use, update to the newest release from ThemeForest and verify the changelog, or apply a virtual patch or mitigation rule via your WAF or security plugin.
- Review web server logs for unusual requests to theme files and check that no sensitive files are readable by the web server.
- If compromise is suspected, rotate database and application credentials.
- Keep WordPress core up to date (confirm WordPress 7.1.2 or later for CVE-2026-87902).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-42704 patchstack.com
- OpenCVE CVE-2026-42704 app.opencve.io
- Vulners CVE-2026-42704 vulners.com
- Vulners Patchstack PATCHSTACK:D719FB9F31594CE9D8A54C534AF5DFA2 vulners.com
- Positive Technologies PT-2026-109772 vulners.com
- Third-party tracker CVE-2026-42704 hol.org
- ThemeForest Kids Care product page themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:13.
Original description (NVD)
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.