Technical impact
This vulnerability allows WordPress site owners to upload files of disallowed or dangerous types to the Eximius theme, enabling attackers to place malicious code that may be executed by the web server. The weakness is classified as CWE‑434, which indicates a failure to verify or filter the file type of user‑supplied uploads. If an attacker uploads a script or executable file and the web server executes it, the attacker can compromise the confidentiality, integrity, and availability of the site.
Affected Systems
The issue affects the dkszone Eximius WordPress theme for all released versions up to and including 2.2. Versions 2.3 and later are not known to be affected according to the vendor statement.
Risk and Exploitability
The vulnerability scores a CVSS of 9.9, reflecting a high risk to exposed sites. The EPSS score is below 1%, suggesting that current exploit activity is minimal, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote through the WordPress administrative interface or any user interface that permits file uploads, which an authenticated user could exploit to upload malicious files, resulting in possible remote code execution.
EUVD