What is the CVSS score of CVE-2025-49060?

CVE-2025-49060 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Wastia WordPress Theme are affected by CVE-2025-49060?

The CMSSuperHeroes Wastia theme, a third-party WordPress theme used across an unknown number of our public-facing sites, contains a maximum-severity flaw that would let an outside attacker place and…

How to fix or mitigate CVE-2025-49060?

Within 24 hours, inventory every externally reachable WordPress instance running the CMSSuperHeroes Wastia theme, and for any site where the theme is not business-critical, deactivate and remove it outright; for sites that must stay online, deploy WAF or reverse-proxy rules that reject file-upload requests targeting the theme directory and block direct execution of PHP under wp-content/uploads and wp-content/themes, and review web server and application logs for POST requests to theme paths and for newly created PHP files. Within 7 days, complete a file-integrity scan and webshell sweep of all affected hosts, restrict administrative access to the WordPress dashboard by IP allowlist or VPN, rotate credentials, salts, and any keys stored on or reachable from affected servers, and confirm whether the vendor has published a fixed release authorized as version 1.1.3 or later, applying it as soon as it is validated in staging. Within 30 days, migrate off the Wastia theme to an actively maintained alternative if no reliable vendor fix is confirmed, re-verify server hardening so upload and theme directories cannot execute code, and add the theme to our component inventory and patch-tracking process so that unsupported third-party themes are retired before they become standing exposure.

Wastia WordPress Theme CVE-2025-49060

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-10-22 audit@patchstack.com

PHP WordPress File Upload Wordpress Theme

10.0

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote file upload yielding web-shell RCE gives full CIA impact; Scope is Unchanged since the web shell executes within the same web application/host, not across a security boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: PHP added

Analysis Generated

Sep 26, 2026 - 00:30 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3.

AnalysisAI

Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers to upload a web shell to the web server, which typically results in remote code execution under the web server's user context. The assessed CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation requires no authentication or user interaction, although the specific vulnerable upload endpoint is not named in the available data and Patchstack-class file-upload flaws can in practice require an authenticated role, which could not be confirmed from the supplied sources. There is no indication of confirmed active exploitation (no CISA KEV entry) and no public exploit code has been identified at time of analysis; no EPSS data was provided, and the practical exposure is limited by deployment scope since only sites running this niche theme are affected.

Technical ContextAI

The flaw is a classic CWE-434 unrestricted upload of a file with a dangerous type, located in the CMSSuperHeroes Wastia WordPress theme. WordPress themes frequently ship custom AJAX or form-based file upload handlers (for example for logo, slider, or media fields) that fail to validate file extension, MIME type, or content before writing the file into a web-accessible directory; when PHP or other executable types are accepted, an attacker can drop a web shell and invoke it over HTTP to run arbitrary commands. The advisory referenced by NVD is the Patchstack database entry for the Wastia theme, which categorizes the issue as an arbitrary file upload fixed in version 1.1.3. The CPE data supplied in this input is empty, so the exact affected package identifiers could not be enumerated beyond the theme name and version range stated in the description; the vendor is CMSSuperHeroes and the affected artifact is specifically the theme, not the WordPress core. Note the score derivation: the upstream vector uses S:C (scope changed), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; both evaluate to a base score of 10.0 and the underlying weakness and impact class are the same.

Affected ProductsAI

The affected product is the Wastia theme for WordPress, published by CMSSuperHeroes, in all versions from the initial release through any version earlier than 1.1.3 (described as 'from n/a through < 1.1.3'). Version 1.1.3 is the first fixed release according to the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wastia/vulnerability/wordpress-wastia-theme-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve. Only WordPress installations with this theme installed and active are exposed; the vulnerability is in the theme's upload handling, not in WordPress core or in unrelated plugins. No CPE strings or vendor product identifiers were supplied with the intelligence data beyond the theme name and version range.

RemediationAI

Update the Wastia theme to version 1.1.3 or later, which is the fixed release identified by the vendor advisory; this is the primary and complete remediation and should be applied immediately on any site running an earlier version. If the theme cannot be updated promptly, deactivate or remove it entirely as the strongest compensating control, accepting the loss of the site's intended design, or, if the theme must stay live, block requests that attempt to write executable file types (for example PHP, PHTML, PHAR) into wp-content/uploads and theme directories using a WAF or web server rule, understanding that such filters can be bypassed via extension or MIME tricks and may break legitimate media uploads. Additional hardening includes disabling PHP execution in the uploads directory via server configuration, restricting write permissions on theme directories, and auditing the site for dropped web shells and unexpected administrative users, since a successful exploitation grants code execution and effectively full site control. The vendor advisory URL for tracking the fix is https://patchstack.com/database/Wordpress/Theme/wastia/vulnerability/wordpress-wastia-theme-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve. Given that exploitation conditions could not be fully confirmed as unauthenticated from the description alone, sites should treat any pre-1.1.3 installation as compromised until proven otherwise.