The vulnerability is a Cross‑Site Request Forgery flaw in the Appointment theme that permits an attacker to upload arbitrary files under the control of the web server. By exploiting this flaw, an attacker can upload a web shell, thereby achieving remote code execution on the server hosting the WordPress site. The weakness is identified as CWE‑352, meaning that request forgery leads to unauthorized actions affecting confidentiality, integrity, and availability.

The weakness affects all installations of the Appointment theme by priyanshumittal running version 3.5.5 or earlier. Sites that have not upgraded beyond 3.5.5 remain vulnerable.

The CVSS base score of 9.6 marks this as a high‑severity flaw, while the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. Nonetheless, when exploited the risk is severe due to the potential for remote code execution. The flaw is not listed in the CISA KEV catalog, but that does not reduce the urgency of remediation. The likely attack vector involves a crafted request from an authenticated or session‑maintaining user that bypasses CSRF protections, allowing arbitrary file upload.