TechOne WordPress theme: Unauthenticated Local File Inclusion
Summary
The TechOne WordPress theme up to and including version 3.0.3 contains an unauthenticated Local File Inclusion flaw (CWE-98). An attacker can send a crafted request to make the website load server files it should not access, which can expose sensitive data such as configuration files and, depending on the setup, lead to a full site takeover. No login is required, but attack complexity is high. No fixed version is known yet.
Affected
- TechOne WordPress theme (vendor: kutethemes) up to and including 3.0.3
- Product identity not fully confirmed by the vendor or advisory
Fixed in
Unknown. No vendor advisory or fixed version has been found; do not assume that a version is patched.
Workaround
- Deactivate and remove the theme if it is not in active use (back up first)
- Put a web application firewall with virtual patching in front of affected public sites
- Restrict filesystem access for the web server and keep PHP and the server patched
- Do not use nulled or free copies of premium themes for testing
Exploitation
- No known exploitation in the wild; not listed in CISA KEV
- No public proof of concept found in the research
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Patchstack rates it as high priority and expects future exploitation
Our recommendation
- Inventory all WordPress sites for the TechOne theme and check the installed version
- Deactivate the theme where it is not needed and apply virtual patching for affected public sites
- Check the vendor and Patchstack pages regularly for a fixed release
- Review web server logs for unusual parameters on theme-related URLs
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress TechOne theme <= 3.0.3 Local File Inclusion patchstack.com
- OpenCVE: CVE-2026-62094 app.opencve.io
- Vulners: CVE-2026-62094 vulners.com
- Vulners: Patchstack PATCHSTACK:6231878BB45AAF8BF73EB1F652A11DCE vulners.com
- HOL Guard: CVE-2026-62094 hol.org
- Strix: CVE-2026-62094 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:02.
Original description (NVD)
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.