CVE-2026-62020: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Mikado-Themes TouchUp

This vulnerability (CVE-2026-62020) in Mikado-Themes TouchUp is caused by improper control of filenames used in include or require statements in PHP, enabling unauthenticated local file inclusion. The issue affects versions before 1.4. Exploitation can result in remote code execution or disclosure of sensitive files. The CVSS 3.1 score is 8.1, reflecting network attack vector with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and no privileges or user interaction.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, monitor the vendor's communications for updates. Until a fix is available, restrict access to the vulnerable application and consider additional protective controls such as web application firewalls to mitigate exploitation risk.