CVE-2023-54352
WordPress Seotheme has a critical remote code execution flaw that lets anyone upload and run PHP files in the theme folder, giving full control over the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the Seotheme theme (any version) are affected.
Real-world impact
An attacker can upload a PHP shell and run arbitrary commands, upload more files, and maintain persistent access to the site.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability is exploitable over the network, requires no authentication, and gives attackers full control (high confidentiality, integrity, and availability impact).
What to do about it
- ›Remove or disable the Seotheme theme from the WordPress installation.
- ›Delete any files in the /wp-content/themes/seotheme/ directory, especially any PHP files.
- ›Ensure the theme directory is not writable by the web server.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 8, 2026 · Jun 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.