TouchUp WordPress theme: Unauthenticated local file inclusion
Summary
The TouchUp WordPress theme before version 1.4 contains a local file inclusion vulnerability (CWE-98) that can be exploited without authentication. An attacker can make the website load server files it should not access, which can in some cases lead to a full takeover. Exploitation requires high complexity (CVSS AC:H), and the theme must be installed on the public site.
Affected
- TouchUp WordPress theme versions below 1.4
- Current release per vendor changelog: 1.6
Fixed in
- Version 1.4 or later per Patchstack and the CVE record; the current release is 1.6
Workaround
- No vendor workaround documented.
- If an update is not possible immediately, the site owner can disable the theme if it is not in use or restrict public access to the site until it is patched.
Exploitation
- Not known to be exploited (CISA SSVC: exploitation none, not automatable, total technical impact).
- Patchstack rates it as high priority and expects exploitation; no public proof of concept was found in the research.
Our recommendation
- Check whether any public WordPress site runs the TouchUp theme, especially medical or clinic sites.
- Update TouchUp to version 1.6 (at least 1.4) and confirm that WordPress Core is up to date.
- Review web server logs for unusual file parameters and monitor for further activity.
- If the theme is not in use, remove it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: TouchUp theme < 1.4 Local File Inclusion patchstack.com
- Vulners Patchstack entry PATCHSTACK:1D1DB8C1A034E952D5C1D3772DD1F67B vulners.com
- Strix CVE-2026-62020 www.strix.ai
- HOL Guard CVE-2026-62020 hol.org
- OpenCVE CVE-2026-62020 app.opencve.io
- ThemeForest TouchUp theme page themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:11.
Original description (NVD)
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.