CVE-2026-39613
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Boutique (kute-boutique) WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Risk Assessment
The risk involves reading sensitive files, potentially leading to disclosure of credentials or other confidential information.
Recommendation
Update the Boutique theme to a version newer than 2.3.3 or apply temporary mitigations.
Other vulnerabilities in Boutique
See all- CVE-2026-62099High
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-62098Medium
The Boutique plugin in versions up to 2.3.3 contains an unauthenticated content injection vulnerability. An unauthenticated attacker can inject arbitrary content.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS