An improper validation of filenames used in PHP include or require statements within the Boutique theme permits an attacker to influence the file that the theme includes. If the attacker can point the theme to a file containing PHP code, that code may be executed with the website’s permissions. The flaw corresponds to CWE-98, describing uncontrolled or unsafe file inclusion.

The Boutique theme distributed by Kutethemes for WordPress is affected. All releases of the theme with a version number of 2.3.3 or earlier are vulnerable, and no newer release has been identified in the public record.

The CVSS score of 7.5 places this vulnerability in the high severity range. The EPSS score of less than 1% indicates that exploitation in the wild is unlikely. The issue is not listed in the CISA KEV catalog. The likely attack vector is via a web request to the WordPress site that contains the Boutique theme, where the attacker can tamper with the filename parameter used in the theme’s include logic.