TI-2026-70368 Aliases CVE-2026-62020 GHSA-qf5w-f57c-pmpg

WordPress TouchUp theme Local File Inclusion vulnerability

LOW 37CWE-98Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-98.

Summary

The WordPress TouchUp theme by Mikado-Themes is affected before 1.4. A flaw in how the theme builds filenames for include statements lets an unauthenticated remote attacker include local files. The CVSS 3.1 vector rates the attack as high complexity, requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability. CISA's KEV catalog does not list it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00338 27th percentileScored 2026-11-07

Fix Fixed TouchUp (Mikado-Themes): 1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mikado-Themes	TouchUp	before 1.4	1.4	Patch available	CNA

TouchUp VendorMikado-Themes Affected before 1.4 Fixed in 1.4 Patch available CNA

Remediation

Update the TouchUp theme to version 1.4 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA TouchUp (Mikado-Themes) Fixed in 1.4

Timeline

2026-10-11 Threatist record created from CVE-2026-62020
2026-10-11 Alias added: GHSA-qf5w-f57c-pmpg

References

Other 1

https://patchstack.com/database/wordpress/theme/touchup/vulnerability/wordpress-touchup-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve

TI-2025-01400 Qi Blocks < 1.4 - Contributor+ Stored XSS via ToC Block CVSS 3.1MEDIUM 5.4
TI-2025-01399 Qi Blocks < 1.4 - Contributor+ Stored XSS vi Countdown Block CVSS 3.1MEDIUM 5.4
TI-2025-01398 Qi Blocks < 1.4 - Contributor+ Stored XSS via Counter Block CVSS 3.1MEDIUM 5.4
TI-2024-11397 Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user CVSS 3.1CRITICAL 9.8
TI-2025-12371 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
TI-2026-46716 WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3

See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences