Mymoun Backhoe WordPress theme: Unauthenticated Local File Inclusion
Summary
The Backhoe WordPress theme in version 2.0 and older contains an unauthenticated Local File Inclusion vulnerability (CWE-98). A remote attacker without a login can make the website load files from the server that it should not access, which can lead to disclosure of sensitive data and, in some cases, to a full takeover of the site. Exploitation requires no user interaction, but the attack complexity is rated high.
Affected
- Backhoe WordPress theme, versions 2.0 and older (<= 2.0)
- Newer versions: Unknown. Version information in third-party listings conflicts.
Fixed in
- Unknown. No fixed version has been confirmed by the vendor or Patchstack.
Workaround
- No vendor or Patchstack workaround known.
- Restrict access to the website at the web application firewall level until a fix or replacement is available.
- Patchstack has issued a mitigation rule for this vulnerability (per the Patchstack advisory).
Exploitation
- Not listed in the CISA KEV catalog.
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- EPSS score: 0.00338.
- No public proof of concept found.
- Patchstack rates the issue as high priority and expects exploitation.
Our recommendation
- Check whether any website uses the Backhoe theme and identify the installed version.
- Treat any internet-facing Backhoe site as high priority.
- Place the site behind a web application firewall or restrict access while a replacement is prepared.
- Plan to replace the theme with a maintained alternative, since no fix is confirmed.
- Review web server logs for unusual file access requests.
- Monitor the Patchstack advisory and the vendor's changelog for an update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-62075 app.opencve.io
- Vulners RAPID7 CVE-2026-62075 vulners.com
- CVE Threatint CVE-2026-62075 cve.threatint.com
- ThemeDetect Backhoe www.themedetect.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:10.
Original description (NVD)
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.