The KuteShop theme contains an improper control of the filename in a PHP include/require statement that allows a local file inclusion. An attacker who can trigger the vulnerable code can read arbitrary files from the server, and if the file contains executable code, the attacker could potentially run PHP on the server. This weakness can compromise the confidentiality and integrity of the website data and may lead to full site takeover.

The vulnerability affects the kutethemes KuteShop WordPress theme in all releases up through version 4.2.9. Any WordPress installation that has a KuteShop theme version 4.2.9 or older is potentially exposed.

The CVSS score is 7.5 and the EPSS score is below 1 percent, indicating a moderate severity with a low expected exploitation probability. The issue is not listed in CISA’s KEV catalog, so no known large‑scale exploit activity is recorded. The likely attack vector is through a crafted HTTP request that causes the theme code to include a local file, which would be feasible on sites where the theme file paths are exposed or where an attacker can influence the include path. Knowledge of the theme’s internal structure and the presence of the vulnerable code would be required to exploit the flaw.