Executive brief
The Travelscape theme for WordPress, used for travel-related websites, contains a critical security flaw in its file upload feature. This vulnerability allows anyone on the internet to upload and run malicious code on the website's server without needing a password. An attacker could use this to take full control of the website, steal sensitive data, or disrupt business operations.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in the WordPress Theme Travelscape version 1.0.3 and earlier. The flaw stems from insufficient validation of user-supplied files within the theme's upload functionality. An unauthenticated, remote attacker can exploit this by sending a specially crafted request to upload a malicious script (such as a PHP webshell) directly to the theme directory. Once uploaded, the attacker can execute the file to achieve full remote code execution (RCE) on the underlying server. Public exploit code is available on Exploit-DB.
Affected products
- WordPress Theme Travelscape Travelscape <= 1.0.3
Timeline
- 2024-04-01: other: Exploit first authored
- 2026-06-08: advisory: NVD publication date