WordPress Appointment Theme Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Upload
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Appointment theme, specifically in versions through 3.5.5. This vulnerability allows attackers to trick users with higher privileges into uploading a web shell to the server, potentially leading to unauthorized access or control.
Impact
Exploitation of this vulnerability could enable a malicious actor to upload a web shell to the server, allowing for arbitrary code execution or unauthorized access.
Remediation
Users are advised to update the Appointment theme to the latest version. If unable to update, consult with your hosting provider or web developer for assistance.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.