Themagnifico52
Monthly
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Charity Zone WordPress theme (versions 1.1.1 and prior) allows authenticated users with only Subscriber-level privileges to upload files of attacker-chosen type, leading to remote code execution under the web server context. The flaw was disclosed via Patchstack and carries a CVSS 9.9 due to the scope change from a low-privileged WordPress role to full server compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file upload in the Kids Gift Shop WordPress theme (versions 0.5.4 and earlier) allows authenticated users with Subscriber-level privileges to upload arbitrary files to the server. The CVSS 3.1 score of 9.9 with scope change reflects the potential for remote code execution leading to full site compromise, and no public exploit identified at time of analysis.
Arbitrary file upload in the Ecommerce Zone WordPress theme (versions <= 0.9.7) allows authenticated low-privileged users (Subscriber role) to upload files of attacker-chosen types, resulting in a CVSS 9.9 critical scoring with scope change. No public exploit identified at time of analysis, and the issue was reported by Patchstack via their WordPress vulnerability database. Successful exploitation typically leads to remote code execution on the underlying web server.
Arbitrary file upload in the Restaurant Zone WordPress theme through version 0.7.8 allows authenticated attackers with only Subscriber-level privileges to upload arbitrary files to the underlying server, leading to remote code execution and full site compromise. The CVSS 3.1 score of 9.9 reflects the scope-changing impact achievable from a minimally privileged account; no public exploit is identified at time of analysis and the issue is not currently listed in CISA KEV.
Arbitrary file upload in the Kids Online Store WordPress theme (versions up to and including 0.8.9) by themagnifico52 allows authenticated attackers to upload web shells and achieve remote code execution on the underlying server. The flaw is reported by Patchstack and carries a CVSS 3.1 score of 9.9 due to the scope-changing impact on the WordPress host. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Charity Zone WordPress theme (versions 1.1.1 and prior) allows authenticated users with only Subscriber-level privileges to upload files of attacker-chosen type, leading to remote code execution under the web server context. The flaw was disclosed via Patchstack and carries a CVSS 9.9 due to the scope change from a low-privileged WordPress role to full server compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file upload in the Kids Gift Shop WordPress theme (versions 0.5.4 and earlier) allows authenticated users with Subscriber-level privileges to upload arbitrary files to the server. The CVSS 3.1 score of 9.9 with scope change reflects the potential for remote code execution leading to full site compromise, and no public exploit identified at time of analysis.
Arbitrary file upload in the Ecommerce Zone WordPress theme (versions <= 0.9.7) allows authenticated low-privileged users (Subscriber role) to upload files of attacker-chosen types, resulting in a CVSS 9.9 critical scoring with scope change. No public exploit identified at time of analysis, and the issue was reported by Patchstack via their WordPress vulnerability database. Successful exploitation typically leads to remote code execution on the underlying web server.
Arbitrary file upload in the Restaurant Zone WordPress theme through version 0.7.8 allows authenticated attackers with only Subscriber-level privileges to upload arbitrary files to the underlying server, leading to remote code execution and full site compromise. The CVSS 3.1 score of 9.9 reflects the scope-changing impact achievable from a minimally privileged account; no public exploit is identified at time of analysis and the issue is not currently listed in CISA KEV.
Arbitrary file upload in the Kids Online Store WordPress theme (versions up to and including 0.8.9) by themagnifico52 allows authenticated attackers to upload web shells and achieve remote code execution on the underlying server. The flaw is reported by Patchstack and carries a CVSS 3.1 score of 9.9 due to the scope-changing impact on the WordPress host. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.