An unauthenticated content injection flaw allows attackers to insert arbitrary shortcodes into the Boutique WordPress theme, leading to potential code execution when the page is rendered. This is a classic code injection vulnerability catalogued as CWE‑94, where unvalidated input can be interpreted as executable code.

WordPress users employing the Boutique theme from Kutethemes with a version that is 2.3.3 or earlier are affected. No specific patches are listed for any higher or later releases, so any installation of 2.3.3 or older remains at risk.

The vulnerability is scored as a CVSS 6.5, indicating moderate severity. The exploit probability is not available through EPSS, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be unauthenticated content injection, meaning that any web visitor or user with the ability to submit content can inject malicious shortcodes, potentially leading to remote code execution without further authentication.