Critical severity · published Jun 8, 2026
CVE-2024-58349
WordPress Theme Travelscape 1.0.3 Arbitrary File Upload
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Travelscape · WP Travel Kit
1.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58349
www.exploit-db.com
https://www.exploit-db.com/exploits/51969
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-theme-travelscape-arbitrary-file-upload
More from Travelscape
9.8
CVE-2023-54352
WordPress Seotheme Remote Code Execution Unauthenticated