It Residence
Monthly
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.