EUVD-2026-96500
GHSA-5xcc-f8xx-r3h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Boutique theme ≤2.3.3
-
DeliveryCraft request with malicious shortcode payload
-
ExploitSubmit to unauthenticated injection point
-
ExecutionTheme renders attacker shortcode
-
ImpactInject content or disclose limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to have the Kutethemes 'Boutique' theme installed and active at version 2.3.3 or earlier; the vulnerable shortcode-handling path must be reachable. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are needed, so any internet-facing site meeting the version/theme condition is exposed by default. The primary limiting factor is deployment scope: only sites specifically running this commercial theme are affected, and upgrading past 2.3.3 removes the condition. Impact is bounded to content injection / limited data exposure (C:L/I:L/A:N), not server compromise, despite the 'RCE' tag. |
| Impact | Signals are moderate and largely consistent. The NVD-style CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction - attractive to opportunistic scanning - but the impact metrics (S:U/C:L/I:L/A:N, score 6.5) are deliberately limited: only partial confidentiality and integrity, no availability impact and no scope change. This is tagged 'RCE' and 'Code Injection' (CWE-94), yet the Patchstack title and description scope it to 'arbitrary shortcode execution' / 'content injection' rather than full OS/PHP code execution - the CONFLICT between the 'RCE' tag and the limited C:L/I:L/A:N impact strongly suggests shortcode-level injection, not host takeover; treat 'RCE' with caution and verify against the Patchstack advisory. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or at-scale exploitation. Net: a legitimate patch-worthy issue because it is unauthenticated and remote, but the capped impact and absence of exploitation signals place it as medium priority rather than an emergency - prioritize behind any KEV-listed or full-RCE WordPress issues. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Boutique theme (<= 2.3.3), injecting attacker-controlled shortcodes that the theme renders. This allows the attacker to inject content or trigger shortcode-backed functionality to disclose limited information or tamper with rendered pages. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated content injection in the Kutethemes 'Boutique' WordPress theme at version 2.3.3 and earlier lets remote attackers reach a shortcode-handling path and inject arbitrary content into affected sites. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any internet-facing WordPress installation with this commercial theme active is exposed by default; the attack surface is bounded to sites running this specific theme. Impact is assessed as limited content injection and partial data exposure (C:L/I:L/A:N) rather than server compromise, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in unpatched, theme-deployed sites.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to confirm the current fixed release for the Kutethemes 'Boutique' theme against the Patchstack advisory (https://patchstack.com/database/wordpress/theme/kute-boutique/vulnerability/wordpress-boutique-theme-2-3-3-arbitrary-shortcode-execution-vulnerability?_s_id=cve) and upgrade past 2.3.3 as soon as an updated build is published; because the theme is a commercial product, this may require downloading the new package from the vendor rather than the WordPress.org repository. If no fixed build is available, the strongest compensating control is to deactivate and remove the theme from production sites and switch to a maintained alternative, accepting the loss of the theme's page-layout and styling until a fix ships; for sites that must keep it live, reduce reachability of the shortcode path by disabling open commenting, guest posting, and any untrusted contributor roles, restricting who can submit content that is processed for shortcodes, and reviewing existing posts, pages, widgets, and custom fields for injected shortcode payloads and reverting/removing them. Because the vector is PR:N/UI:N, input-filtering and access restrictions on content submission only partially reduce exposure, and a WAF rule that blocks unexpected shortcode syntax in inbound content is a best-effort layer with the trade-off of false positives on legitimate shortcode usage - it should be treated as a stopgap, not a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the WordPress shortcode subsystem as implemented by the Kutethemes 'Boutique' theme (CPE cpe:2.3:a:kutethemes:boutique, which covers all versions of the theme). WordPress parses shortcodes such as [example attr="value"] from post, page, and other user-influenced content and passes them to registered handler callbacks; the advisory title ('arbitrary shortcode execution') and the CWE-94 mapping indicate that the theme's handler fails to validate or sanitize the shortcode input it processes, allowing attacker-supplied input to be interpreted as executable shortcode logic rather than inert text. This is the classic code-injection root-cause class where data crosses into an interpreted/executable context without neutralization, so the injected shortcode can drive the theme's callback to emit or alter page content. It is important to distinguish the 'RCE' and 'Code Injection' tags attached to this record from the assessed impact: the authoritative CVSS vector yields only low confidentiality and low integrity with no availability impact (S:U, C:L/I:L/A:N), consistent with content injection and limited data exposure rather than arbitrary server-side code execution. Because the vector is PR:N/UI:N, the vulnerable path is reachable without credentials and without tricking a victim into clicking anything, and the only meaningful gating factor is whether the shortcode-handling code path is reachable on a given deployment.
Know when Boutique gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated remote shortcode injection needs no interaction (AV:N/AC:L/PR:N/UI:N); impact is limited content injection/disclosure, so C:L/I:L/A:N with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Content Injection in Boutique <= 2.3.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique)
Local file inclusion in kutethemes Boutique WordPress theme versions ≤2.3.3 allows authenticated attackers with low priv
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the kutethemes Boutique WordPress theme versions prior to
Exploit-DB