Boutique: Unauthenticated local file inclusion in WordPress theme
Summary
The WordPress theme Boutique (Kute Fashion WooCommerce theme) in versions up to and including 2.3.3 contains a local file inclusion vulnerability (CWE-98). An unauthenticated remote attacker can make the site load server files it should not, which can expose configuration files such as database credentials and may lead to a takeover of the site. Patchstack rates the issue as high priority, but CISA SSVC rates exploitation as none and no public proof of concept was found.
Affected
- Boutique WordPress theme, versions up to and including 2.3.3
- Lower bound of the affected range: Unknown.
Fixed in
- Unknown. No vendor fix has been confirmed.
Workaround
- Verify the installed theme version. Any version 2.3.3 or earlier is affected.
- Check whether the theme is a nulled or pirated copy and replace it with a licensed, maintained version.
- If the theme is not in use, deactivate and remove it.
- Apply a web application firewall or virtual patch that blocks file inclusion request patterns, if one is available for this CVE.
- Restrict PHP file access on the web server where possible and review logs for suspicious parameters in theme requests.
Exploitation
- No known exploitation reported; not listed as known exploited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS about 0.0028.
- Public proof of concept: none found.
- Patchstack describes the issue as highly dangerous and expected to be exploited.
Our recommendation
- Check all WordPress sites for the Boutique theme and its version now.
- Apply the workarounds above until a fixed version is confirmed.
- Update to a fixed release as soon as the vendor or Patchstack confirms one.
- Make sure backups are current and monitor the Patchstack and ThemeForest pages for an updated release.
- Review web server logs for file inclusion attempts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: Boutique theme Local File Inclusion patchstack.com
- Vulners CVE record CVE-2026-62099 vulners.com
- Vulners Patchstack entry PATCHSTACK:01FDACE33FBDDCDF8DA4A939C2DF2B8E vulners.com
- HOL Guard CVE-2026-62099 summary hol.org
- OpenCVE CVE-2026-62099 app.opencve.io
- ThemeForest Boutique support page themeforest.net
- Boutique theme vendor page on Plugins for WP pluginsforwp.com
- VulnTitan Kute Boutique theme vulntitan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:03.
Original description (NVD)
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.