WordPress sites that use the DukaMarket theme version 1.3.0 or earlier are vulnerable to an unauthenticated local file inclusion flaw. This weakness allows an attacker to supply crafted input that resolves to any file on the server and cause the theme to read it. If sensitive files such as configuration files, user data, or PHP source files are accessed, the attacker could gain information or exploit further weaknesses, including potential remote code execution if the read content is subsequently executed or parsed. The vulnerability is identified as CWE‑98.

The vulnerability affects WordPress installations that have installed the DukaMarket theme from Kutethemes, specifically versions 1.3.0 or lower. No other plugins or WordPress core components are mentioned as affected.

The CVSS score of 8.1 indicates a high severity, and the EPSS score is not available in the current report. Because the flaw is unauthenticated and can be triggered via a simple HTTP request to the theme’s endpoint, it is considered highly exploitable in practice. The vulnerability is not listed in the CISA KEV catalog at this time, but its high CVSS and lack of authentication requirements mean that a determined adversary can target it quickly.