CVE-2024-58349
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability. Unauthenticated attackers can upload malicious files by exploiting insufficient validation in the theme's upload functionality.
Risk Assessment
Attackers can upload arbitrary files to the theme directory and execute them, achieving remote code execution on the affected WordPress installation.
Recommendation
Update the Travelscape theme to the latest version or replace it with a more secure theme. Restrict file upload capabilities for untrusted users.
Original NVD description (English source)
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.