CVE-2023-54352
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
WordPress Seotheme has a remote code execution vulnerability. Unauthenticated attackers can execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php.
Risk Assessment
An attacker can execute arbitrary system commands and upload additional files for persistent access to the WordPress server.
Recommendation
Update the Seotheme theme to the latest version or replace it with a more secure theme. Remove the file /wp-content/themes/seotheme/mar.php if it exists.
Original NVD description (English source)
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.