A Cross‑Site Request Forgery flaw in the WordPress Appointment theme lets a user upload an arbitrary file to the web server without any authentication checks. By uploading a malicious script such as a PHP web shell, an attacker can obtain remote code execution and compromise the integrity and confidentiality of the affected WordPress site.

The flaw is present in the Appointment theme created by priyanshumittal and applies to every released version up to and including 3.5.5; no newer versions are identified in the CVE entry.

The vulnerability requires the attacker to get a victim to follow a crafted request that triggers the upload endpoint. Because the request is not protected by a CSRF token, any user who loads a malicious page can trigger the upload, making the attack relatively easy if influential users can be lured. While the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the possibility of arbitrary file upload gives the vulnerability a high potential for exploitation should an attacker gain the ability to generate the required request.