Executive brief
The WordPress Seotheme (specifically the Travelscape theme) contains a critical security flaw that allows unauthorized individuals to take complete control of a website. By uploading a malicious file to the server, an attacker can remotely execute commands, steal sensitive data, or install persistent backdoors. This requires no login credentials and can be performed over the internet, posing a severe risk to the website's integrity and customer data.
Technical details
A remote code execution (RCE) vulnerability exists in the WordPress Seotheme (Travelscape <= 1.0.3) due to missing authentication for critical functions (CWE-306). An unauthenticated attacker can exploit this by uploading a malicious PHP file directly to the theme directory. Once uploaded, the attacker can access the file (typically at /wp-content/themes/seotheme/mar.php) to execute arbitrary system commands and upload further tools for persistent access. The vulnerability is easily exploitable over the network without user interaction. Public exploit code is available.
Affected products
- WordPress Seotheme Travelscape <= 1.0.3
Timeline
- 2023-09-20: other: Vulnerability discovered by researcher
- 2024-02-09: disclosed: Exploit published on Exploit-DB
- 2026-06-08: advisory: NVD publication date