CVE-2022-0316

Multiple themes - Unauthenticated Arbitrary File Upload

The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.

Affected

WeStand · footysquare · aidreform · statfort · club-theme · kingclub-theme

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.08% chance of exploitation in the next 30 days, 81st percentile

Published

2023-01-23

Updated

2025-04-03

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c
• KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit11★ · 2023-02-09

References

• CVE Record
• NVD entry

Related

• CVE-2019-10869
• CVE-2019-12815
• CVE-2019-9978
• CVE-2024-13513
• CVE-2024-31351
• CVE-2024-42640