The Boutique Word theme, versions 2.3.3 and earlier, contains an unauthenticated Local File Inclusion flaw. The theme fails to validate the file path used in a PHP include statement, enabling an attacker to load arbitrary local files. This weakness can expose sensitive configuration or server data. The vulnerability is classified as CWE‑98.

WordPress sites that have the Kutethemes Boutique theme version 2.3.3 or earlier deployed are affected. No other products or versions are identified as impacted.

The CVSS score of 8.1 classifies this flaw as high severity. Authentication is not required, so any user capable of crafting a request to the site may trigger the vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of those metrics does not lower the inherent risk. Attacks are likely to involve manipulating query parameters or form inputs that the theme uses in its inclusion logic, leading to disclosure of local files.