The Busiprof WordPress theme contains a Cross‑Site Request Forgery flaw that permits an attacker to upload arbitrary files, including web shells, to the site’s server. This enables the attacker to execute code with the web server’s privileges, effectively compromising the website. The weakness is classified as CWE‑352.

All WordPress sites that use the Busiprof theme version 2.5.2 or earlier are vulnerable. Affected installations include any instance where the theme has not yet been updated beyond the specified version.

The vulnerability carries a CVSS base score of 9.6, placing it in the critical range and indicating that successful exploitation would result in complete compromise. The EPSS probability is below 1 %, suggesting that exploit attempts are currently rare, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a forged request from a user who has permission to upload files, such as a content editor or administrator, who is tricked into submitting a malicious payload. Once the request is processed, the attacker can place a web shell in the upload directory and execute arbitrary code.