WordPress SpicePress Theme Cross-Site Request Forgery Vulnerability Allowing Web Shell Upload
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress SpicePress theme, specifically in versions through 2.3.2.5. This vulnerability allows attackers to trick users with higher privileges into uploading a web shell to the server, potentially leading to unauthorized access or control.
Impact
Exploitation of this vulnerability could enable a malicious actor to upload a web shell to the server, allowing for remote code execution.
Remediation
Users are advised to update the SpicePress theme to the latest version. If unable to update, consult with your hosting provider or web developer for assistance.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.