Biolife WordPress theme: Unauthenticated local file inclusion

Summary

The Biolife WordPress theme by kutethemes, up to and including version 3.2.3, contains an unauthenticated local file inclusion flaw. An unauthenticated remote attacker may be able to make the web server load files it should not access, which can expose sensitive data and, in some cases, lead to a site takeover. Exploitation is rated as having high complexity, and no public exploit has been reported.

Affected

• Biolife WordPress theme by kutethemes, versions up to and including 3.2.3
• Premium theme sold on ThemeForest, not in the wordpress.org repository

Fixed in

Unknown. No fixed version or vendor advisory from kutethemes was found.

Workaround

• No vendor mitigation found.
• Patchstack has published a mitigation rule for the vulnerability according to its entry; verify availability for your setup.
• Restrict access to the affected site where possible and review web server logs for unusual file-path parameters.
• Ensure file permissions and PHP configuration limit what the web server can read.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV.
• No public proof of concept or exploit report was found.
• Patchstack rates the flaw as high priority and expects exploitation, which differs from the CISA assessment.

Our recommendation

• Check whether any site uses the Biolife theme, including staging and abandoned sites.
• If it is in use, ask kutethemes for a patched version and check the ThemeForest account or changelog for updates.
• If no fix is available, consider replacing or removing the theme, since an inactive theme still exposes files.
• Apply the Patchstack mitigation or a web application firewall rule where possible, and monitor web server logs.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-62096 patchstack.com
• OpenCVE CVE-2026-62096 app.opencve.io
• Vulners CVE-2026-62096 vulners.com
• ThemeForest Biolife product page themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:03.