The CMSSuperHeroes Clanora theme includes an unrestricted upload mechanism that permits the transfer of files categorized as dangerous types. This flaw, identified as CWE‑434, enables an attacker to place malicious files on a WordPress site. The CVE description notes only the ability to upload such files; it does not specify the subsequent effects if those files are executed or accessed.

All installations of the Clanora WordPress theme with a version older than 1.3.1 are affected. No specific patch version is mentioned beyond the stated threshold, so any deployment running a pre‑1.3.1 release is potentially vulnerable.

The CVSS score of 10 points classifies this vulnerability as critical. The EPSS score is below 1 %, indicating that exploitation is not widely observed, though it remains possible. The issue is not listed in CISA’s KEV catalog. The CVE description does not detail the attack vector or authentication requirements, so it is unclear whether the upload endpoint requires administrative privileges or can be accessed publicly. The vulnerability’s primary risk lies in the ability to upload arbitrary content that the server may treat as executable or otherwise malicious.