What is the CVSS score of EUVD-2026-20249?

EUVD-2026-20249 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-20249?

kutethemes Boutique WordPress theme versions 2.3.3 and earlier contain a local file inclusion vulnerability that allows low-privilege authenticated users to execute arbitrary code and access…

How to fix or mitigate EUVD-2026-20249?

Within 24 hours: audit all WordPress installations to identify kutethemes Boutique theme deployments and current version numbers; disable or remove the theme immediately if version ≤2.3.3. Within 7 days: implement strict WordPress user role policies to restrict authenticated access, disable unnecessary user accounts, and review user access logs for suspicious file inclusion attempts. Within 30 days: contact kutethemes for patch availability; migrate to an alternative WordPress theme or re-enable only after vendor releases version >2.3.3 with confirmed fix.

PHP EUVD-2026-20249

| CVE-2026-39613 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-08 Patchstack

GHSA-p53h-m58m-98mh

PHP Information Disclosure LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20249

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.

AnalysisAI

Local file inclusion in kutethemes Boutique WordPress theme versions ≤2.3.3 allows authenticated attackers with low privileges to include arbitrary PHP files, leading to high-severity impacts including information disclosure, code execution, and system compromise. Exploitation requires network access with high attack complexity. No public exploit identified at time of analysis. Authenticated attack vector (PR:L) limits exposure to users with existing credentials.

Technical ContextAI

CWE-98 improper filename control in PHP include/require statements enables authenticated users to manipulate file paths and include local files. High attack complexity (AC:H) suggests exploitation requires specific conditions or race conditions. Affects kutethemes Boutique WordPress theme (CPE 2.3:a:kutethemes:boutique). Low observed exploitation activity (EPSS 0.05%, 17th percentile).

RemediationAI

No vendor-released patch identified at time of analysis for Boutique theme version >2.3.3. Recommended immediate actions: (1) Deactivate and remove Boutique theme if not business-critical; (2) Switch to actively maintained WordPress theme from trusted vendor; (3) Implement Web Application Firewall rules to block suspicious include/require patterns; (4) Audit user accounts and enforce principle of least privilege to limit low-privileged access; (5) Monitor file access logs for anomalous PHP include attempts. Consult Patchstack advisory for updates: https://patchstack.com/database/Wordpress/Theme/kute-boutique/vulnerability/wordpress-boutique-theme-2-3-3-local-file-inclusion-vulnerability?_s_id=cve