CVE-2024-58349: WordPress Theme Travelscape 1.0.3 Arbitrary File Upload
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WordPress Theme Travelscape 1.0.3from your environment.Uninstall or disable the Travelscape theme (version 1.0.3) from affected WordPress installations until a vendor-supplied fix is available.
- Compensating control
Prevent execution of uploaded files in the theme directory and block malicious uploads: e.g., disable PHP execution in the theme directory via webserver configuration or .htaccess, restrict access to theme upload endpoints to trusted/administrative users, and deploy WAF rules to block malicious file upload requests.
- Operational
Inspect the theme and uploads directories for suspicious or newly added files, remove any malicious files found, restore compromised files from known-good backups, and if compromise is suspected, rotate credentials and keys associated with the WordPress site.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58349?
CVE-2024-58349 has a severity score of 9.8, classified as critical.
What vulnerability does CVE-2024-58349 describe?
CVE-2024-58349 describes an arbitrary file upload vulnerability in WordPress Theme Travelscape 1.0.3.
How do I fix CVE-2024-58349?
To fix CVE-2024-58349, update WordPress Theme Travelscape to the latest version that addresses the arbitrary file upload vulnerability.
Who is affected by CVE-2024-58349?
CVE-2024-58349 affects websites using WordPress Theme Travelscape version 1.0.3.
What impact can CVE-2024-58349 have on a website?
CVE-2024-58349 can allow unauthenticated attackers to upload and execute malicious files on a vulnerable website.