This vulnerability allows an attacker to upload files to the WordPress web server without restriction. The upload mechanism accepts dangerous file types, enabling the injection of a web shell or other executable code. An attacker that can upload a shell can then execute arbitrary commands on the server, compromising confidentiality, integrity, and availability of the hosting environment.

The flaw exists in the Nutrie theme distributed by zozothemes. Any installation using a version older than 2.0.1 is affected. Versions from n/a through all versions less than 2.0.1 are vulnerable.

The CVSS score of 9.9 reflects a high risk for remote code execution. The EPSS score is under 1 %, indicating low current exploitation activity, but the lack of presence in CISA KEV does not diminish the potential impact. The attack vector is inferred to be through the theme’s file upload interface accessible to authenticated WordPress administrators or users with upload privileges. Successful exploitation does not require network‑level access and can be executed by anyone who can reach the governance interface of the vulnerable WordPress installation.