What is the CVSS score of CVE-2025-48106?

CVE-2025-48106 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Clanora Theme are affected by CVE-2025-48106?

A critical vulnerability in the Clanora WordPress theme (all versions before 1.3.1) allows an unauthenticated attacker to upload and execute malicious files on the web server, giving them full…

How to fix or mitigate CVE-2025-48106?

Within 24 hours, inventory all internet-facing WordPress sites and confirm which ones run the Clanora theme; where the theme is non-essential, deactivate and remove it immediately, and where it must remain, place the site behind a web application firewall, disable PHP execution in upload directories, and enable detailed logging and file-integrity monitoring on the webroot. Within 7 days, contact the theme vendor to confirm whether version 1.3.1 resolves the flaw, since the affected range is stated as all versions before 1.3.1, and upgrade to 1.3.1 or later as soon as the fix is confirmed; if no vendor patch is released, migrate affected sites to an actively maintained alternative theme, deploy virtual patching rules that block executable file uploads, and audit the webroot and WordPress uploads directories for webshells or recently modified files. Within 30 days, complete migration off the unpatched theme across the entire estate, add file-upload abuse and webshell indicators to continuous monitoring and alerting, rotate credentials and secrets stored on affected hosts, and conduct a post-remediation review to confirm no attacker persistence remains on previously exposed servers.

Clanora Theme CVE-2025-48106

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-10-22 audit@patchstack.com

PHP WordPress File Upload Wordpress Theme

10.0

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote upload of executable files gives full host compromise (C/I/A:H); scored S:U because a webshell on the WP host stays within the same security authority, unlike Patchstack's S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: PHP added

Analysis Generated

Sep 26, 2026 - 00:30 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1.

AnalysisAI

Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to place executable files on the server, leading to webshell placement and remote code execution. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no special configuration, and no user interaction are required against default installations. No public exploit code or confirmed active exploitation has been identified at time of analysis; the critical severity rating (10.0 from NVD, 9.8 per our assessment) reflects the direct path to full server compromise.

Technical ContextAI

The vulnerability is an instance of CWE-434 (Unrestricted Upload of File with Dangerous Type) in the Clanora theme developed by CMSSuperHeroes for WordPress. The theme exposes a file-upload feature that fails to validate the type of uploaded files, permitting an attacker to submit a file with a dangerous extension such as .php. Because WordPress themes are executed in the web server context, a successfully uploaded PHP file can be requested directly, resulting in arbitrary code execution. The CVSS 3.1 vector indicates network reachability with low complexity and no privileges or user interaction, matching a worst-case upload endpoint that is accessible to unauthenticated visitors. No CPE strings were provided, but the affected component is unambiguously the Clanora theme (versions below 1.3.1).

Affected ProductsAI

The CMSSuperHeroes Clanora WordPress theme is affected in all versions prior to 1.3.1. The vulnerability is present when the theme is active on a WordPress site and the theme's file-upload functionality is reachable by unauthenticated requests. No specific CPE string was supplied, but the vendor advisory from Patchstack (https://patchstack.com/database/Wordpress/Theme/clanora/vulnerability/wordpress-clanora-theme-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve) explicitly addresses Clanora versions from n/a through < 1.3.1.

RemediationAI

Update the Clanora theme to version 1.3.1 or later, which is the vendor-released patch that resolves this issue. If immediate updating is not possible, disable or remove the theme's file-upload feature entirely - this breaks any legitimate upload functionality but eliminates the attack vector. Additionally, configure the web server to block execution of PHP files in the WordPress uploads directory and restrict access to the vulnerable upload endpoint by IP or authentication; these compensating controls may be bypassed if the upload path changes, and blocking PHP execution could interfere with other plugins that legitimately process uploads. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/clanora/vulnerability/wordpress-clanora-theme-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve for any further guidance.