The vulnerability exposes an unrestricted file upload interface that permits the upload of arbitrary files, including executable scripts. An attacker can use the flaw to place a web shell on the server, enabling the execution of arbitrary code and potentially full compromise of the WordPress site. This weakness is a classic file upload vulnerability classified as CWE-434, leading to remote code execution, which can compromise confidentiality, integrity, and availability.

All installations of the LiquidThemes LogisticsHub WordPress theme version 1.1.6 or earlier are vulnerable. The flaw applies to every deployment that has not upgraded beyond version 1.1.6.

With a CVSS score of 10, the flaw is rated as critical. The EPSS score of less than 1% indicates that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves utilizing the theme’s upload functionality; based on the description, it is inferred that an attacker would need authenticated upload privileges to exploit the issue, although the CVE does not explicitly state whether unauthenticated uploads are possible.