WordPress Theme Travelscape 1.0.3 includes an arbitrary file upload flaw that allows attackers without authentication to place malicious files in the theme directory. The vulnerability stems from insufficient validation of uploaded file types, which means that an attacker can upload a script and then execute it on the server, gaining full control of the compromised WordPress installation.

The affected product is the WordPress theme Travelscape, version 1.0.3, bundled with the WP Travel Kit. Systems running this theme without an updated version are vulnerable.

The CVSS score of 9.3 reflects a high likelihood of exploitation with potential for complete compromise. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of any authentication requirement means an attacker can exploit this flaw from any unauthenticated network connection to the WordPress site. Consequently, the risk remains high until the vulnerability is mitigated.