The vulnerability arises from a flaw in the Seotheme WordPress theme that permits an attacker to upload arbitrary PHP files without authentication. Uploading such a file creates a shell that can be accessed via the theme directory, enabling execution of system commands, file uploads and persistent control over the web server. This level of access compromises confidentiality, integrity and availability of the affected site and the underlying infrastructure.

The flaw affects installations of the WordPress Seotheme theme within the WP Travel Kit:Travelscape product. No specific version numbers are disclosed in the advisory, so all versions referenced by the vendor should be checked for the patch. The theme is typically found under wp-content/themes/seotheme, and the vulnerability can be exploited by any user with the ability to upload files to that directory.

The CVSS score of 9.3 indicates critical severity. Exploit probability information (EPSS) is not available, and the issue is not listed in the CISA KEV catalog. The likely attack path is unauthenticated remote exploitation via HTTP uploads; an attacker can freely upload a malicious PHP shell to the theme directory, then use it to run arbitrary code on the host. Because authentication is not required, the exposure is wide and the risk is high.