DukaMarket WordPress theme: Unauthenticated local file inclusion

Summary

The DukaMarket WordPress theme up to and including version 1.3.0 contains an unauthenticated local file inclusion flaw (CWE-98). A remote attacker without a login can make the site load arbitrary server files, which may allow reading sensitive data and, in some cases, remote code execution. Patchstack rates the issue as high priority, but CISA's SSVC data shows no known exploitation and no automation.

Affected

• DukaMarket WordPress theme, version 1.3.0 and earlier (per CNA range <= 1.3.0)

Fixed in

• Unknown. No fixed version is confirmed in the sources reviewed; a version above 1.3.0 is the only generic guidance.

Workaround

• No vendor workaround published.
• Restrict access to the affected site where possible and ask the hosting provider about web application firewall rules or virtual patching.

Exploitation

• Not known exploited; not in the CISA KEV list.
• CISA SSVC: exploitation none, automatable no.
• No confirmed public proof of concept; one unverified third-party scanner listing exists.
• EPSS approx. 0.3%.

Our recommendation

• Identify all sites running the DukaMarket theme and check the installed version.
• If the theme is not needed, deactivate and remove it, or move to a maintained theme.
• If it must stay, apply vendor updates above 1.3.0 once available and ask the hosting provider for virtual patching.
• Review web server logs for unusual file-path parameters and requests to the theme directory.
• Create and verify backups before making changes.
• Check that the theme was not obtained from nulled or GPL copies on third-party sites.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-48194 app.opencve.io
• Vulners CVE-2026-48194 vulners.com
• ThemeForest DukaMarket listing themeforest.net
• Armour Infosec LFI guidance github.com
• Kutethemes support support.kutethemes.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:11.