CVE-2022-0316: Multiple themes - Unauthenticated Arbitrary File Upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-23 · updated 2026-06-17

Description

The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.

Affected products

Aidreform Project Aidreform: all versions
Chimpgroup Bolster: all versions
Chimpgroup Spikes: all versions
Chimpgroup Westand: before 2.1 — fixed in 2.1
Club-Theme Project Club-Theme: all versions
Footysquare Project Footysquare: all versions
Pixfill Kings Club: all versions
Soundblast Project Soundblast: all versions
Spikes-Black Project Spikes-Black: all versions
Statfort Project Statfort: all versions

How to fix

Upgrade to a fixed version: Chimpgroup Westand 2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0316 or the next vulnerability affects your stack