CVE-2026-39613

CVE-2026-39613 is a PHP Remote File Inclusion vulnerability affecting kutethemes Boutique versions 2.3.3 and earlier, caused by improper control of filenames in PHP include/require statements. This flaw allows attackers to perform local file inclusion attacks, potentially exposing sensitive files or executing arbitrary code on affected systems. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network attack vector, high complexity, and low privileges required. An authenticated attacker can achieve high impact across confidentiality, integrity, and availability without requiring user interaction. The EPSS score of 0.00127 indicates this is a relatively low-probability vulnerability compared to other disclosed CVEs. There is currently no evidence of active exploitation or community interest in this vulnerability. It has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on exploit tracking lists, suggesting minimal real-world attack activity at this time. However, the high CVSS rating warrants prompt patching for affected Boutique installations.