The vulnerability stems from improper control of filenames used in PHP include/require statements within the WordPress Boutique theme. This flaw allows an attacker to cause the application to include arbitrary local files, potentially exposing sensitive configuration files or logs. If the included files contain executable code, an attacker could achieve remote code execution, giving full control over the compromised site.

WordPress sites deploying the kutethemes Boutique theme, version 2.3.3 or earlier. The issue applies to all releases from the initial launch up to and including 2.3.3. Users of newer versions are not affected.

No CVSS score is available and the EPSS value is missing, but the flaw is severe due to its potential to lead to arbitrary code execution. The vulnerability can be exploited remotely by manipulating URLs or input that feeds the filename variable, making it accessible to anyone hosting the affected theme. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of a public exploit does not diminish the risk, as the attack path is straightforward and requires no special conditions.