The vulnerability is an arbitrary file upload flaw that allows an attacker to upload a web shell to the target WordPress site. The flaw stems from improper type validation, marked as CWE‑434, and can enable execution of malicious code. Attackers can place executable files or scripts that grant control over the web server, leading to full system compromise, data exfiltration, or defacement.

Vendors affected are CMSSuperHeroes for the Wastia theme. All versions prior to 1.1.3 are vulnerable, including unspecified older releases up to 1.1.2. Any WordPress installation using these versions of the Wastia theme is at risk.

The CVSS score of 10 indicates maximum severity, while the EPSS score of less than 1% suggests exploitation attempts are unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the theme’s file upload interface, where an attacker with the ability to submit files can upload a web shell. No additional prerequisites are specified, so the flaw likely remains exploitable whenever the upload feature is enabled.