CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.
Explanation of Vulnerability in Simple Terms
WP Travel Kit Travelscape contains a missing authentication vulnerability affecting version 1.0.3. An attacker can access sensitive functionality without credentials over the network. The vulnerability requires no user interaction and grants high-impact access to confidential data and system integrity. Immediate patching is required.
What an attacker can do
Access sensitive features and data without logging in.
Potential impact on your site
Unauthorized users can read and modify site data without a valid account.
Conditions required to exploit
Network access to the affected Travelscape installation; no authentication required.
Key dates
External resources
Related vulnerabilities
