CVE-2026-62099
HighCVSS 8.1Summary
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
Risk Assessment
An unauthenticated attacker may read sensitive files from the server, risking leakage of configuration data or credentials.
Recommendation
Update the Boutique theme to a version newer than 2.3.3 or disable it if an update is not possible.
Other vulnerabilities in Boutique
See all- CVE-2026-62098Medium
The Boutique plugin in versions up to 2.3.3 contains an unauthenticated content injection vulnerability. An unauthenticated attacker can inject arbitrary content.
- CVE-2026-39613High
The Boutique (kute-boutique) WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Original NVD description (English source)
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS