KuteShop WordPress theme: Local File Inclusion without authentication

Summary

The KuteShop WordPress theme up to and including version 4.2.9 contains an unauthenticated Local File Inclusion vulnerability (CWE-98). An remote attacker without a login can make the website load server files it should not access, which may expose sensitive files such as wp-config.php and can under some conditions lead to a takeover. The CVSS vector assumes high attack complexity, so specific conditions are required, and these are not documented in the sources. No fixed version and no vendor advisory have been found, and the vendor's support status is unknown.

Affected

• KuteShop WordPress theme, versions up to and including 4.2.9
• Products listed under CVE-2026-39611 for the same product and versions are related; it is unclear whether they are duplicates

Fixed in

Unknown.

• No fixed version or vendor advisory found

Workaround

• Deactivate and remove the theme if it is not in active use
• If it must remain, restrict access at web-server or WAF level and monitor logs for requests with file-path parameters
• No vendor-specific WAF rule is known

Exploitation

• Known exploited: no
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof of concept found
• Patchstack reports a mitigation rule is available

Our recommendation

• Check all WordPress sites for the KuteShop theme and its exact version; treat 4.2.9 and older as vulnerable
• Remove or deactivate the theme where it is not needed
• Restrict access to internet-facing sites via WAF and monitor logs for file-path parameters
• Assume files readable by the web server may have been exposed; review access logs and rotate database and API credentials if exposure is suspected
• Contact kutethemes or ThemeForest for a fixed release and check the Patchstack page for updates

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability record patchstack.com
• OpenCVE CVE-2026-62115 app.opencve.io
• VulDB CVE-2026-62115 vuldb.com
• Vulners CVE-2026-62115 vulners.com
• Vulners Patchstack record vulners.com
• KuteShop on ThemeForest themeforest.net
• OpenCVE CVE-2026-39611 (related record) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:04.