CVE-2024-58349 | WordPress Theme Travelscape 1.0.3 contains an arbitrary file… | CVSS 9.8 CRITICAL

Description

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

Metadata

CVE ID: CVE-2024-58349
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-06 10:58 UTC
Published: 2026-06-08 01:55 UTC
Last updated: 2026-06-08 12:59 UTC
Primary CWE: CWE-434
Unrestricted Upload of File with Dangerous Type
Vendor / Product: WP Travel Kit / Travelscape
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
WP Travel Kit	Travelscape	—	1.0.3

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	Unrestricted Upload of File with Dangerous Type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

ExploitDB-51969 https://www.exploit-db.com/exploits/51969
VulnCheck Advisory: WordPress Theme Travelscape 1.0.3 Arbitrary File Upload https://www.vulncheck.com/advisories/wordpress-theme-travelscape-arbitrary-file-upload