CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
Explanation of Vulnerability in Simple Terms
Travelscape versions 1.0.3 and earlier contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the site without authentication or user interaction. This allows execution of malicious code on the server. Site administrators should update to a version newer than 1.0.3 immediately.
What an attacker can do
Upload and execute arbitrary files on the site without authentication.
Potential impact on your site
Attacker can run malicious code on your server, potentially compromising the entire site and user data.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
