First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-52707

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Mikado-Themes	Kastell	<= 2.0

References

https://patchstack.com/database/wordpress/theme/kastell/vulnerability/wordpress-kastell-theme-2-0-local-file-inclusion-vulnerability?_s_id=cve

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-527084.3Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Secu CVE-2026-527096.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gal CVE-2026-52717.8pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. CVE-2026-527105.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for Wo CVE-2026-527117.5Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-527127.6Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-527135.4Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve CVE-2026-527145.9Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-527159.3Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-527166.5Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.CVE-2026-527186.5A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() fun CVE-2026-527197.1An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length

CVE-2026-52707: High severity, CVSS 8.1 | Vulnix