CVE-2024-58349

9.3 criticalEPSS 0.7%

Critical (9.3). EPSS 0.7% chance of exploitation in the next 30 days.

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-06-08
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://www.exploit-db.com/exploits/51969
https://www.vulncheck.com/advisories/wordpress-theme-travelscape-arbitrary-file-upload

Check your stack JSON