The SpicePress theme for WordPress includes a Cross‑Site Request Forgery (CSRF) weakness that allows an attacker to upload a web shell and install arbitrary plugins. This flaw can lead to complete remote code execution on the web server, compromising confidentiality, integrity and availability of the site. The vulnerability is classified as CWE‑352, a request‑forge weakness.

WordPress sites using the SpicePress theme from any version prior to 2.3.2.6 (i.e., n/a through 2.3.2.5) are affected. The issue is specific to the spicethemes SpicePress product and impacts all installations of that theme within the stated version range.

The CVSS score of 8.8 indicates high severity and the EPSS score is reported as less than 1%, suggesting a low probability of widespread automated exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to exploit the CSRF flaw by having an authenticated user submit a malicious form that triggers the upload of a web shell and subsequent plugin installation. Because the flaw operates through form submissions, the attack vector is likely an authenticated user interacting with a malicious site that sends the request to the target WordPress instance.