CVE-2022-0316
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.08% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- aidreform project/aidreform · chimpgroup/bolster · chimpgroup/spikes · chimpgroup/westand · club-theme project/club-theme · footysquare project/footysquare · pixfill/kings club · soundblast project/soundblast · spikes-black project/spikes-black · statfort project/statfort
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7cExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.