The Photography theme’s upload functionality permits files of any type to be uploaded without proper validation. This unrestricted upload coupled with path traversal allows an attacker to place malicious files on the server. If such files are executable, the attacker could achieve remote code execution, compromising the entire site. This vulnerability exemplifies invalid input handling (CWE‑434).

ThemeGoods Photography WordPress theme versions earlier than 7.7.6 are affected. Any WordPress site using those releases is exposed to the described risk.

The CVSS score of 7.2 classifies the flaw as high severity. The EPSS score is below 1 %, indicating that exploitation is currently uncommon, and the vulnerability is not listed in the national Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is the theme’s web‑based file upload form; an attacker would submit a crafted file that bypasses type checks and uses path traversal to place it on the server where it could be executed.