CVE-2023-54352: WordPress Seotheme RCE Vulnerability

CVE-2023-54352 Overview

CVE-2023-54352 is a remote code execution vulnerability affecting the WordPress Seotheme theme. The flaw allows unauthenticated attackers to upload arbitrary PHP files directly to the theme directory. Once uploaded, attackers access the malicious shell at /wp-content/themes/seotheme/mar.php to execute system commands.

The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function. It carries a CVSS 4.0 score of 9.3, reflecting network reachability, no authentication requirements, and high impact across confidentiality, integrity, and availability.

Critical Impact
Unauthenticated attackers can achieve full remote code execution on WordPress sites running Seotheme, enabling complete site compromise, data exfiltration, and persistent backdoor installation.

Affected Products

WordPress Seotheme (theme component)
WordPress installations with the Seotheme theme deployed
Sites exposing /wp-content/themes/seotheme/ to the public internet

Discovery Timeline

2026-06-08 - CVE-2023-54352 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2023-54352

Vulnerability Analysis

The vulnerability stems from missing authentication on a file upload endpoint within the Seotheme WordPress theme. An attacker sends a crafted HTTP request to upload a PHP file directly into the theme directory. The web server then executes the uploaded file when the attacker requests it through the URL path.

The exploit chain is straightforward. First, the attacker uploads a PHP shell named mar.php to the theme directory. Next, the attacker requests /wp-content/themes/seotheme/mar.php and passes parameters that execute arbitrary system commands. Finally, the attacker uses the shell to upload additional payloads for persistent access.

Public exploit code exists in Exploit-DB #51789, increasing the likelihood of opportunistic scanning and exploitation. The VulnCheck Security Advisory documents the unauthenticated nature of the flaw.

Root Cause

The theme exposes a file upload handler without authentication or authorization checks. There is no verification that the requester is an authenticated administrator. The handler also lacks file type validation, allowing .php files to be written to a web-accessible directory.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker scans for WordPress sites running Seotheme, submits a crafted upload request, and then invokes the resulting PHP shell over HTTP to execute commands as the web server user.

No verified proof-of-concept code is reproduced here. Refer to the linked Exploit-DB entry for the technical request structure used in the public exploit.

Detection Methods for CVE-2023-54352

Indicators of Compromise

Presence of mar.php or other unexpected .php files within /wp-content/themes/seotheme/
HTTP GET or POST requests to /wp-content/themes/seotheme/mar.php in web server access logs
Outbound network connections from the web server process to attacker-controlled hosts following theme directory writes
Web shell command parameters such as cmd=, exec=, or base64-encoded payloads in URL query strings targeting the theme path

Detection Strategies

Monitor file integrity in WordPress theme directories and alert on any new PHP file creation outside of patching windows
Inspect web server logs for POST requests writing to wp-content/themes/ paths from unauthenticated sessions
Deploy web application firewall rules that block file uploads with executable extensions targeting theme directories
Correlate web server child process spawns (sh, bash, cmd.exe) with HTTP requests to theme PHP files

Monitoring Recommendations

Enable file system audit logging on /wp-content/themes/ for all create, write, and modify operations
Track HTTP 200 responses to URLs containing mar.php and review the requesting IP addresses
Alert on PHP processes executing system commands or spawning shells, a pattern consistent with web shell activity
Forward web server access logs and host telemetry to a centralized SIEM for cross-source correlation

How to Mitigate CVE-2023-54352

Immediate Actions Required

Remove or disable the Seotheme theme on all affected WordPress installations until a vendor patch is confirmed
Search the file system for mar.php and other unauthorized PHP files in theme directories and remove them
Rotate all WordPress administrator credentials, database passwords, and API keys that may have been exposed
Review web server access logs for prior exploitation attempts and inspect hosts for persistence artifacts

Patch Information

No confirmed vendor patch is referenced in the available CVE data. Operators should monitor the VulnCheck Security Advisory and the WordPress theme vendor for remediation updates. Until a patched version is available, removing the theme is the only reliable mitigation.

Workarounds

Block public access to /wp-content/themes/seotheme/mar.php and similar suspicious paths at the web server or WAF layer
Configure the web server to deny PHP execution within theme upload directories using directives such as php_flag engine off in .htaccess
Restrict write permissions on theme directories so that the web server account cannot create new PHP files at runtime
Place the WordPress site behind a WAF with rules that block unauthenticated file uploads to wp-content paths

bash

# Apache configuration example to block PHP execution in the affected theme directory
<Directory "/var/www/html/wp-content/themes/seotheme">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# Locate and remove known web shell artifacts
find /var/www/html/wp-content/themes/ -name "mar.php" -type f -print -delete