Description
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
Published: 2026-10-10
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Local File Inclusion
Action: Upgrade Theme
AI Analysis

Impact

The vulnerability is an unauthenticated local file inclusion flaw that allows an attacker to access arbitrary files on the server. By manipulating user input, the secret paths to internal files can be disclosed or executed. This weakness is identified as CWE‑98, which is a classic input validation issue that can lead to serious confidentiality and integrity violations.

Affected Systems

The flaw affects the WordPress KuteShop theme from Kutethemes, versions 4.2.9 and earlier. Any WordPress site that has installed or is running these legacy theme versions is susceptible.

Risk and Exploitability

The vulnerability has a high CVSS score of 8.1 and is not currently listed in the CISA KEV catalog. EPSS data is unavailable, but the description indicates the attack vector is unauthenticated, allowing an attacker to trigger the inclusion via a crafted request. There are no known exploit uses reported, yet the high severity rating suggests that organizations should treat this as a substantial risk.

Generated by OpenCVE AI on October 10, 2026 at 21:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the KuteShop theme to the latest available version (≥4.3.0) to apply the fix for the LFI flaw.
  • Restrict the theme’s file access by ensuring that its configuration does not expose local file paths or allow arbitrary includes; set strict file permissions on sensitive directories.
  • Deploy a web application firewall or adjust the PHP include path settings to block attempts to read or execute private files, and monitor server logs for suspicious inclusion attempts.

Generated by OpenCVE AI on October 10, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
Title WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:53:06.600Z

Reserved: 2026-07-13T06:15:14.350Z

Link: CVE-2026-62115

cve-icon Vulnrichment

Updated: 2026-10-11T11:43:50.943Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:43.813

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-62115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T21:45:17Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')