CVE-2024-58349
WordPress Theme Travelscape version 1.0.3 contains an arbitrary file upload flaw that lets unauthenticated attackers upload malicious files to the theme directory and execute them, leading to remote code execution. The vulnerability stems from insufficient validation of uploaded files and has a CVSS v4.0 base score of 9.3 (critical).
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of WordPress Theme Travelscape version 1.0.3.
Real-world impact
Attackers can achieve remote code execution on the affected WordPress site, potentially compromising the server and data.
Why this severity
The CVSS v4.0 score of 9.3 reflects a network‑accessible, low‑complexity attack requiring no privileges or user interaction, with high impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 8, 2026 · Jun 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.