Boutique WordPress Theme CVE-2026-62099

Exploitation requires the target site to be running the Boutique WordPress theme by kutethemes at version 2.3.3 or earlier, reachable over the network. The flaw is unauthenticated (PR:N) and needs no user interaction (UI:N), so no login or victim action is required. The limiting factor is CVSS AC:H: successful exploitation depends on conditions the attacker does not fully control - such as crafting the include path correctly, server PHP configuration (allow_url_include/wrapper availability for escalation to code execution), and the specific vulnerable parameter/endpoint. Impact beyond reading local files (i.e., the input's I:H/A:H) is conditional on LFI-to-RCE techniques being viable in the target's PHP environment and is not confirmed by the description.

This is a genuinely serious-looking flaw on paper (CVSS 8.1, AV:N/PR:N/UI:N with C:H/I:H/A:H) but several signals temper the real-world urgency. The CVSS vector indicates a network-reachable, unauthenticated vulnerability requiring no user interaction, which is the worst-case access profile; however, AC:H explicitly flags that successful exploitation depends on conditions outside the attacker's control (specific request crafting, timing, or configuration), which lowers the practical ease of attack. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is NO evidence of active or probable exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data is not itself proof of low risk, but combined with the niche WordPress theme footprint it suggests this is NOT a widespread-exploitation priority. CWE-98 (improper control of filename for include/require) is classically Remote/Local File Inclusion; the single reference and the 'Information Disclosure'/'LFI' tags imply the primary realistic impact is file disclosure, which is in tension with the input's I:H/A:H integrity and availability ratings - verify with Patchstack whether PHP code execution (via LFI-to-RCE techniques) is actually achievable before treating I:H/A:H as confirmed. Net: patch promptly on affected sites, but this is a moderate-priority, low-prevalence issue rather than a mass-exploitation emergency.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Boutique theme (<= 2.3.3), abusing a parameter that is passed into a PHP include/require to load an arbitrary local file (e.g., wp-config.php or other sensitive files). Because AC:H applies, the attacker must satisfy specific conditions to succeed; in PHP environments this can potentially be escalated from file disclosure toward code execution via known LFI techniques. No public exploit code was identified at the time of analysis.