Armania WordPress theme: Unauthenticated local file inclusion
Summary
The Armania WordPress theme from kutethemes, versions 1.4.8 and older, contains an unauthenticated local file inclusion vulnerability. A remote attacker without an account can make the web server load local files it should not access, which can expose sensitive data and in some cases lead to a full takeover of the site. Exploitation requires a high attack complexity according to CVSS, and CISA's assessment lists no known exploitation and no automatable exploitation.
Affected
- Armania WordPress theme, versions 1.4.8 and older (vendor range per CVE record: less than or equal to 1.4.8)
- Child themes based on affected versions
Fixed in
Unknown. No fixed version has been confirmed by the vendor or Patchstack. Do not assume 1.4.9 fixes this issue until confirmed.
Workaround
- No vendor workaround published.
- Virtual patching via a WordPress web application firewall (for example Patchstack) if available.
- Restrict access to non-public paths and the theme's file-handling endpoints where feasible.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- No public proof of concept found at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Patchstack rates the issue as high priority and expects exploitation.
Our recommendation
- Identify all sites running Armania and child themes and confirm the installed version.
- If an update is not available, apply a virtual patch or disable the theme where possible.
- Review web server and access logs for unusual requests to the theme.
- Remove the theme if it is not in active use.
- Monitor the vendor changelog and Patchstack for a confirmed fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-62092 app.opencve.io
- Vulners CVE-2026-62092 vulners.com
- Vulners Patchstack mirror vulners.com
- HOL Guard CVE-2026-62092 hol.org
- ThemeForest Armania product page themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:04.
Original description (NVD)
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.