VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jun 8, 2026

CVE-2024-58349

CVE-2024-58349

Description

WordPress Theme Travelscape 1.0.3 allows unauthenticated arbitrary file uploads, leading to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

WordPress Theme Travelscape 1.0.3 allows unauthenticated arbitrary file uploads, leading to remote code execution.

Vulnerability

WordPress Theme Travelscape version 1.0.3 contains an arbitrary file upload vulnerability due to insufficient validation in its upload functionality. This allows attackers to upload malicious files to the theme directory [2].

Exploitation

Unauthenticated attackers can exploit this vulnerability by uploading arbitrary files to the theme directory. The vulnerability does not require any specific user interaction or authentication [2]. Reference [1] provides a Python script demonstrating the exploit.

Impact

Successful exploitation allows attackers to upload and execute arbitrary files on the affected WordPress installation, leading to remote code execution (RCE) with the privileges of the web server [2].

Mitigation

WordPress Theme Travelscape version 1.0.3 is affected. No patched version or specific mitigation steps are disclosed in the available references. Users should consider disabling or removing the theme if an update is not available [2].

References
  1. OffSec’s Exploit Database Archive
  2. WordPress Theme Travelscape 1.0.3 Arbitrary File Upload

AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The theme's upload functionality lacks sufficient validation, allowing arbitrary file uploads."

Attack vector

Unauthenticated attackers can exploit the insufficient validation in the Travelscape theme's upload functionality to upload malicious files. By uploading arbitrary files to the theme directory, attackers can then execute these files to achieve remote code execution on the affected WordPress installation. The exploit targets a PHP file within the theme for this purpose [ref_id=1].

Affected code

The vulnerability lies within the upload functionality of the WordPress Travelscape theme version 1.0.3. Specifically, the exploit targets a PHP file within the theme's directory, indicating a flaw in how file uploads are handled by the theme's code [ref_id=1].

What the fix does

The provided bundle does not contain information about a patch or specific remediation steps. Therefore, the advisory does not specify how the vulnerability is fixed. Users are advised to update to a secure version if available or consult vendor advisories for mitigation strategies.

Preconditions

  • configThe target must be running WordPress with the Travelscape theme version 1.0.3 installed.
  • authThe attacker does not require any authentication to exploit this vulnerability.

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.