The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to upload an arbitrary file, including a web shell, to the web server. Because the file is uploaded under the privileges of the authenticated WordPress user, a malicious actor can gain remote code execution capabilities. The weakness is classified under CWE‑352 and could compromise the confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites that use the Busiprof theme by priyanshumittal, version 2.5.2 or earlier are affected. The vulnerability exists in all earlier releases up to and including 2.5.2.

The exploit requires a valid authenticated session to perform the CSRF request, so it is limited to users with administrative or editor access to the WordPress dashboard. Once a web shell is uploaded, the attacker can execute arbitrary code on the server. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the impact is severe and the attack vector is likely to be web‑based and exploitable by any authenticated user who can reach the site. The overall risk is high for sites that still run the vulnerable theme.