CVE-2026-42704: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in axiomthemes Kids Care

This vulnerability (CVE-2026-42704) in the Kids Care theme (<= 3.2.4) arises from improper control of filenames used in PHP include or require statements, classified as CWE-98. It enables unauthenticated attackers to perform Local File Inclusion (LFI), which can lead to remote code execution or disclosure of sensitive files. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to include arbitrary local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.