The Keenarch WordPress theme allows an untrusted user to upload files of any type without proper validation, as described by CWE-434. This flaw lets an attacker place malicious scripts or executables on the web server, effectively compromising the confidentiality, integrity, and availability of the site. Successful exploitation can result in full site compromise, data theft, defacement, or the use of the host as part of a botnet.

All installations of the zozothemes Keenarch theme that are on a version prior to 2.0.1 are affected. The vulnerability applies to every release version in the range from the first available version (n/a) up to but not including 2.0.1.

The CVSS base score of 9.9 indicates a critical level of severity, while the EPSS score of less than 1% signals a low current exploitation probability. The vulnerability is not yet included in the CISA KEV catalog. The likely attack vector is through the theme’s file upload interface, which accepts arbitrary file types and executes them if not properly sanitized.