A missing authorization check in Kutethemes KuteShop allows the execution of any shortcode supplied through a web request. Because WordPress parses and evaluates shortcodes within the core platform, an attacker can inject arbitrary shortcode content that may execute custom PHP code, potentially compromising the integrity of the site and enabling further payloads. The flaw is rooted in the theme’s incorrect handling of access control security levels, which permits unauthorized shortcut execution.

WordPress installations that use Kutethemes KuteShop version 4.2.9 or earlier are affected. Any site running the theme within that version range and that has its shortcode functionality enabled is at risk until an updated theme is deployed.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 percent suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Based on the description, the likely attack vector is an unauthenticated web request to a WordPress page that processes shortcodes; the attacker can supply arbitrary input without needing credentials.