Vulnerability · Published Jun 8, 2026 · Assigned by VulnCheck

CVE-2024-58349WordPress Theme Travelscape 1.0.3 Arbitrary File Upload

Critical 9.8

In plain English

A critical-severity unrestricted file upload in Travelscape from WP Travel Kit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 47.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

Affected products (as reported)

Vendor	Product	Versions
WP Travel Kit	Travelscape	1.0.3

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-51969 exploit
VulnCheck Advisory: WordPress Theme Travelscape 1.0.3 Arbitrary File Upload third-party-advisory