Kaven WordPress theme: Unauthenticated Local File Inclusion
Summary
The Kaven WordPress theme by CocoBasic, versions up to and including 1.2, contains a Local File Inclusion vulnerability. An unauthenticated remote attacker can make the website load server files it should not access, which can lead to a full takeover of the site. Exploitation requires high attack complexity, and no public proof-of-concept has been found. No fixed version is known, so affected sites should be treated as unpatched.
Affected
- Kaven WordPress theme by CocoBasic, versions up to and including 1.2
Fixed in
Unknown. No fixed version has been confirmed by the vendor.
Workaround
- No vendor workaround is documented.
- Deactivate and remove the theme if it is not needed.
- If it is needed, consider a maintained alternative theme or a web application firewall or virtual patch in front of the site.
- Review web server logs for unusual file-path parameters.
Exploitation
- Patchstack classifies the issue as high priority and expects exploitation.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV; no known exploitation recorded.
- No public proof-of-concept found in the searches performed.
Our recommendation
- Check whether Kaven is installed on any public website, including the theme folder and WordPress admin.
- Remove the theme where it is not needed.
- Where it is needed, apply a virtual patch or WAF rule and plan a migration to a maintained theme.
- Monitor the vendor and Patchstack for a fixed version and update immediately once available.
- Review logs for suspicious file-path requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress Kaven theme 1.2 Local File Inclusion patchstack.com
- OpenCVE: CVE-2026-62067 app.opencve.io
- Vulners: CVE-2026-62067 vulners.com
- threatint: CVE-2026-62067 cve.threatint.com
- HOL Guard: CVE-2026-62067 hol.org
- ThemeForest: Kaven product page themeforest.net
- CocoBasic Kaven installation manual demo.cocobasic.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:06.
Original description (NVD)
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.