CVE-2026-39612
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The KuteShop WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.2.9.
Risk Assessment
An attacker can gain unauthorized access to theme settings or store data, potentially leading to data theft or store disruption.
Recommendation
Update the KuteShop theme to the latest version and configure appropriate permissions.
Other vulnerabilities in KuteShop
See all- CVE-2026-62115High
The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-62100High
The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
- CVE-2026-39611High
The KuteShop WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Original NVD description (English source)
Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS