Cardea WordPress theme: Unauthenticated Local File Inclusion
Summary
The Cardea WordPress theme up to and including version 2.3 contains an unauthenticated Local File Inclusion vulnerability (CWE-98). An remote attacker without a login can make the website load files from the server that it should not expose, which may reveal configuration data such as database credentials. Under certain conditions this can escalate to code execution or a full site takeover; Patchstack rates the issue as high priority and expects exploitation to become likely.
Affected
- Cardea WordPress theme, versions up to and including 2.3
- Vendor: CocoBasic (sold on ThemeForest)
Fixed in
Unknown. No vendor patch or fixed version has been published at the time of writing.
Workaround
- No vendor workaround published.
- Deactivate and remove the theme if it is not needed.
- Apply virtual patching via a WAF if available; Patchstack has issued a mitigation rule.
Exploitation
- Not listed in CISA KEV; CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found; no known exploitation in the wild at the time of writing.
- EPSS 0.00338 (very low).
Our recommendation
- Check whether the Cardea theme is installed on any WordPress site, including sites managed by agencies, and confirm the version.
- If installed and not needed, deactivate and remove it.
- If it must stay, apply a WAF or Patchstack mitigation and monitor web server logs for file path parameters and requests to the theme.
- Review the site for unexpected files and check whether credentials stored on the server need rotation.
- Watch the Patchstack page and CocoBasic for a fixed release and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-62065 patchstack.com
- OpenCVE CVE-2026-62065 app.opencve.io
- Vulners RAPID7:CVE-2026-62065 vulners.com
- HOL Guard CVE-2026-62065 hol.org
- ThemeForest Cardea theme page themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:05.
Original description (NVD)
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.