KuteShop WordPress Theme EUVD-2026-96503

Exploitation targets the KuteShop WordPress theme at versions 4.2.9 and earlier, requiring that a vulnerable site have this specific commercial theme installed and active; the flaw is reachable without authentication (PR:N) or user interaction (UI:N) over the network (AV:N), so no login or victim action is needed. The limiting factor is the CVSS high attack complexity (AC:H), indicating a specific precondition - likely a particular request format, parameter, or theme configuration/endpoint being accessible - rather than a trivially reproducible default-config exploit; the exact feature or parameter is not named in the available data and must be confirmed against the Patchstack advisory.

The CVSS 3.1 base score of 8.1 (High) is driven by a network attack vector (AV:N), no privileges (PR:N), and no user interaction (UI:N), combined with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with CWE-98 (improper control of filename for include/require), where a Local File Inclusion can escalate to code execution or broad file disclosure. The one tempering signal is high attack complexity (AC:H), which the vector asserts but the description does not explain; this meaningfully lowers real-world exploitability relative to the headline score. Exploitation status: no public exploit identified at time of analysis - the sole source (Patchstack) reports no POC, and there is no EPSS score or CISA KEV listing provided, so there is no evidence of active or at-scale exploitation. On balance this is a credible but not yet urgent priority: a serious unauthenticated flaw in a specific WordPress commercial theme, but with no exploitation signal and an AC:H qualifier. MISSING DATA: EPSS probability, POC status (beyond Patchstack's silence), and any SSVC decision are absent, and the AC:H rating is unexplained by the description (which reads as a straightforward unauthenticated LFI, more typical of AC:L) - verify the complexity assumption with Patchstack/vendor.

A remote, unauthenticated attacker sends a crafted request to a KuteShop theme endpoint that passes attacker-influenced input into a PHP include/require path, causing the server to load an arbitrary local file (e.g., wp-config.php) or, via CWE-98 semantics, a controlled payload leading to code execution. No public exploit code is identified at time of analysis, and the CVSS AC:H rating suggests non-trivial preconditions (such as a specific request sequence or encoding) are needed to reliably trigger the inclusion.