IT Residence EUVD-2026-63316

Exploitation requires an authenticated account at the Subscriber (low-privilege) level per the CVSS vector (PR:L), meaning the attacker must be able to register or otherwise obtain a WordPress account on a site running IT Residence version 3.2.1 or earlier; the vulnerable theme upload feature must be reachable. What limits exploitation: sites that disable open user registration prevent anonymous attackers from self-provisioning the required account, and sites not running IT Residence (or running a future fixed version) are unaffected. No user interaction is needed (UI:N) and no non-default WordPress configuration beyond having registration enabled - which is common on membership, comment, and e-commerce sites - is required.

This is a genuine high-priority issue rather than an inflated CVSS score: the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-reachable, low-complexity, no-user-interaction path requiring only a low-privilege (Subscriber) account, culminating in full confidentiality/integrity/availability loss with scope change - the classic pattern for file-upload-to-webshell RCE. The main mitigating factor is PR:L: exploitation requires an authenticated account, so sites that disable open user registration (Settings > General > 'Anyone can register') materially raise the bar. No CISA KEV listing and no public exploit code have been identified, and EPSS was not provided, so there is no evidence of active or widespread exploitation yet; however, file-upload flaws in WordPress themes are frequently weaponized quickly after disclosure, so any operator running an affected site should treat this as urgent. The CVSS and description are consistent, so no signal conflict is present; the primary uncertainty is the exact fixed version, which is not stated in the provided data.

An attacker registers a free Subscriber account on a WordPress site running IT Residence <= 3.2.1 (or uses an existing low-privilege account), then sends a crafted request to the theme's upload handler containing a PHP web shell disguised or unvalidated by extension/MIME checks. The file lands in a web-accessible directory, and the attacker requests its URL to execute arbitrary code as the web server user, taking control of the site and potentially the host. No public exploit code has been identified at time of analysis, but the low complexity makes independent development straightforward.