This vulnerability arises from improper handling of filenames used in PHP include/require calls within the KuteShop theme. An attacker can manipulate a request to cause the theme to include an arbitrary file from the local filesystem, potentially exposing sensitive configuration data or enabling further exploitation. The weakness is classified as CWE‑98, which affects confidentiality and integrity of the WordPress installation.

WordPress sites that have the KuteShop theme installed and are running a version equal to or older than 4.2.9 are susceptible. Any such installation, regardless of other plugins or themes, must be considered at risk until the theme is upgraded or the flaw is otherwise mitigated.

The flaw allows local file inclusion and can be triggered from the public-facing side of the site where the theme is active. No CVSS or EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves crafting a GET or POST request that manipulates the file path parameter within the theme’s PHP code, requiring only access to the WordPress site’s web interface.