Skip to main content

Wordpress Theme CVE-2025-68554

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-03-05 audit@patchstack.com
WordPress File Upload Wordpress Theme
9.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Re-analysis Queued
Apr 22, 2026 - 21:37 vuln.today
cvss_changed
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 05, 2026 - 06:16 nvd
CRITICAL 9.9

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1.

AnalysisAI

Unrestricted file upload in Keenarch (keenarch) WordPress theme allows uploading web shells for remote code execution.

Technical ContextAI

CWE-434 in keenarch. Missing file type validation enables uploading PHP files.

Affected ProductsAI

Keenarch WordPress theme

RemediationAI

Update the theme. Implement strict file type validation.

More in Wordpress Theme

View all
CVE-2025-1307 CRITICAL
9.8 Mar 04

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
CVE-2019-25142 HIGH POC
8.8 Jun 07

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
CVE-2023-45657 HIGH
8.5 Nov 06

A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
CVE-2020-36721 MEDIUM POC
6.5 Jun 07

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
CVE-2024-52413 CRITICAL
9.8 Nov 16

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
CVE-2020-17362 MEDIUM POC
6.1 Aug 12

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
CVE-2025-26927 CRITICAL
10.0 Apr 15

Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
CVE-2026-81779 CRITICAL
10.0 Aug 31

Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
CVE-2025-49071 CRITICAL
10.0 Jun 17

Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
CVE-2025-30933 CRITICAL
10.0 Jul 04

Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, includ
CVE-2025-50002 CRITICAL
10.0 Jan 22

Farost Energia WordPress plugin allows unrestricted file upload enabling attackers to upload web shells and achieve remo
CVE-2025-58963 CRITICAL
10.0 Oct 22

Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

CVE-2025-68554 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy