What’s Vulnerable › Vulnerabilities

CVE-2024-58349: WordPress Theme Travelscape 1.0.3 Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-08 · updated 2026-07-23
• Weakness: CWE-434

Description

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

Affected products

• WP Travel Kit Travelscape: 1.0.3

References

• https://www.exploit-db.com/exploits/51969
• https://www.vulncheck.com/advisories/wordpress-theme-travelscape-arbitrary-file-upload

Get alerted when CVE-2024-58349 or the next vulnerability affects your stack