CVE-2026-39611
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The KuteShop WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Risk Assessment
The risk includes reading sensitive data like configuration files, potentially leading to privilege escalation.
Recommendation
Update the KuteShop theme to a version newer than 4.2.9 or apply temporary blocking rules.
Other vulnerabilities in KuteShop
See all- CVE-2026-62115High
The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-62100High
The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
- CVE-2026-39612Medium
The KuteShop WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.2.9.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS