CVE-2026-62092
HighCVSS 8.1Summary
Unauthenticated Local File Inclusion (LFI) in Armania versions up to 1.4.8. Allows an attacker to read files from the server without authentication.
Risk Assessment
An attacker can access sensitive files, potentially leading to data leakage or privilege escalation.
Recommendation
Update Armania to the latest version. If not possible, restrict access to the application and implement WAF rules to block LFI.
Other vulnerabilities in Armania
See all- CVE-2026-62091High
Unauthenticated Cross Site Scripting (XSS) in Armania versions up to 1.4.8. Allows an attacker to inject malicious scripts into a victim's browser.
- CVE-2026-39626Medium
The Armania theme for WordPress has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 1.4.8.
Original NVD description (English source)
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS