The vulnerability stems from missing authorization checks in the KuteShop theme, allowing an attacker to insert and execute arbitrary shortcodes. These shortcodes are processed with the full privileges of the WordPress site, meaning that injected code could read, modify, or delete data and potentially compromise the entire site. The weakness corresponds to CWE-862, reflecting an access control failure that enables unauthorized code execution.

WordPress sites running the KuteShop theme version 4.2.9 or earlier, specifically the version series <=4.2.9, are impacted. The issue originates in the KuteShop theme released by the Kutethemes vendor. No specific patches are listed in the provided references, but the problem exists across all builds up to and including 4.2.9.

The CVSS score and EPSS probability are not supplied, so the precise numerical severity is unknown. The vulnerability is not listed in the KEV catalog, indicating that no publicly known exploitation instances exist at this time. Nonetheless, because the flaw allows arbitrary code execution with the permissions of the site, the potential damage is high, especially if an attacker can reach the site without authentication. Without a documented exploit, the risk remains theoretical but credible, warranting urgent remediation.