Exploiting the Photography theme’s upload feature, an attacker can upload files of any type without proper validation. This unrestricted file upload coupled with path traversal enables the attacker to place malicious code on the server, which can then be executed, granting compromise of confidentiality, integrity, and availability. The weakness corresponds to the standard file‑upload vulnerability enumeration.

ThemeGoods Photography WordPress theme versions earlier than 7.7.6 are affected. Site owners using any older release of this theme are exposed to the described risk.

The vulnerability receives a CVSS score of 7.2, indicating a high severity classification, and an EPSS score below 1%, suggesting that exploitation is presently uncommon. The issue is not listed in the national Known Exploited Vulnerabilities catalog. The likely attack vector involves the theme’s web‑based upload form; the attacker submits a crafted file that bypasses type checks, potentially leveraging path traversal to place it in a location that can be executed by the webserver.