EUVD-2026-63316
GHSA-6px3-6pv7-rjgj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable upload endpoint reachable by a self-registerable Subscriber (PR:L), no interaction, yielding webshell RCE that escapes the app context (S:C) with full C/I/A loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
AnalysisAI
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account at the Subscriber (low-privilege) level per the CVSS vector (PR:L), meaning the attacker must be able to register or otherwise obtain a WordPress account on a site running IT Residence version 3.2.1 or earlier; the vulnerable theme upload feature must be reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score: the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-reachable, low-complexity, no-user-interaction path requiring only a low-privilege (Subscriber) account, culminating in full confidentiality/integrity/availability loss with scope change - the classic pattern for file-upload-to-webshell RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber account on a WordPress site running IT Residence <= 3.2.1 (or uses an existing low-privilege account), then sends a crafted request to the theme's upload handler containing a PHP web shell disguised or unvalidated by extension/MIME checks. The file lands in a web-accessible directory, and the attacker requests its URL to execute arbitrary code as the web server user, taking control of the site and potentially the host. … |
| Remediation | No vendor-released patched version is confirmed in the provided data, so the primary action is to upgrade to a release later than 3.2.1 as soon as the theme author (indithemes) publishes one - check the Patchstack advisory (https://patchstack.com/database/wordpress/theme/it-residence/vulnerability/wordpress-it-residence-theme-3-2-1-arbitrary-file-upload-vulnerability) and the theme vendor for the fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using IT Residence theme versions 3.2.1 or earlier and immediately disable or remove the theme to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today