CVE-2026-62020: WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. It is reachable over the network, although exploitation has high attack complexity.

Q: Which installations are affected?

WordPress sites using the TouchUp theme at versions earlier than 1.4 are affected. The provided information does not identify any configuration prerequisite or mitigation other than moving to version 1.4 or later.

Q: What could successful exploitation allow?

The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. Successful exploitation could therefore have serious consequences across all three areas.

Published Oct 10, 2026

Updated

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Affected Software

1 affected component

WordPress TouchUp theme<1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress TouchUp - Cosmetic and Plastic Surgery WordPress Theme to a version that resolves this vulnerability.
Fixed in 1.4

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. It is reachable over the network, although exploitation has high attack complexity.

Which installations are affected?

WordPress sites using the TouchUp theme at versions earlier than 1.4 are affected. The provided information does not identify any configuration prerequisite or mitigation other than moving to version 1.4 or later.

What could successful exploitation allow?

The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. Successful exploitation could therefore have serious consequences across all three areas.

CVE-2026-62020: WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What could successful exploitation allow?