Flipmart WordPress theme: Unauthenticated Local File Inclusion
Summary
The Flipmart WordPress theme up to and including version 2.8 contains a Local File Inclusion vulnerability. An unauthenticated remote attacker can make the site load server files it should not access, which can lead to information disclosure and, in some cases, a full site takeover. The flaw is reachable over the network without a login, so any public WooCommerce shop running an affected version is in scope.
Affected
- Flipmart WordPress theme, all versions up to and including 2.8
Fixed in
- Unknown. No vendor patch or fixed version has been confirmed.
Workaround
- Update to a version newer than 2.8 once one is released.
- If no update is possible, disable the theme or delete its directory.
- Place a web application firewall in front of the site to block path-traversal requests and requests to the theme directory. This is an interim measure only.
Exploitation
- No evidence of exploitation in the wild found.
- Not confirmed as listed in CISA KEV; the catalogue was not queried directly.
- No public proof of concept found; status treated as unknown.
- CISA SSVC: exploitation none, automatable no. EPSS 0.00338.
Our recommendation
- Inventory all Flipmart installations, including inactive themes, and check the version in the style.css header.
- Disable or remove Flipmart 2.8 and earlier on public-facing sites where possible, and switch to a maintained theme.
- If the theme must stay active, apply the WAF rules described above and monitor web server logs for path-traversal attempts.
- Check the Patchstack advisory and the vendor for a fixed version and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-62070 app.opencve.io
- Vulners RAPID7 CVE-2026-62070 vulners.com
- Hol.org CVE-2026-62070 hol.org
- Flipmart theme information themesinfo.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:07.
Original description (NVD)
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.