CVE-2022-0316

Deeper analysis

The vulnerability is an unauthenticated arbitrary file upload flaw present in the lang_upload.php component of multiple WordPress themes developed by ChimpStudio and PixFill, including WeStand (versions before 2.1), footysquare, aidreform, statfort, club-theme, kingclub-theme, spikes, spikes-black, soundblast, and bolster. The root cause is the complete absence of authorization checks and file validation logic, which permits any remote actor to write attacker-controlled content directly to the web server.

An unauthenticated attacker can exploit the issue over the network by sending a crafted HTTP request to the vulnerable upload endpoint. Successful exploitation grants the ability to place arbitrary files, including web shells, resulting in full confidentiality, integrity, and availability impact on the affected site, consistent with the CVSS 9.8 rating.

Public references from WPScan document the affected themes and confirm the missing controls, indicating that site owners should apply vendor updates where available or remove the themes. The EPSS score has reached a peak of 0.3889 with a current value of 0.3637, reflecting sustained exploitation interest after disclosure.