CVE-2024-58349: WordPress Travelscape Theme RCE Flaw

CVE-2024-58349 Overview

CVE-2024-58349 is an arbitrary file upload vulnerability in the WordPress Theme Travelscape version 1.0.3. The theme's upload functionality fails to validate file types and authentication state, allowing unauthenticated attackers to upload arbitrary files to the theme directory. Successful exploitation leads to remote code execution (RCE) on the affected WordPress installation. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated remote attackers can upload PHP webshells and execute arbitrary code, leading to full compromise of the WordPress site and underlying host.

Affected Products

• WordPress Theme Travelscape 1.0.3
• WordPress installations running the vulnerable Travelscape theme
• Web servers hosting Travelscape-based WordPress sites

Discovery Timeline

• 2026-06-08 - CVE-2024-58349 published to NVD
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2024-58349

Vulnerability Analysis

The vulnerability resides in an upload handler exposed by the Travelscape theme. The handler accepts file uploads without enforcing authentication, capability checks, or nonce validation. It also fails to restrict file extensions or validate MIME types, allowing PHP and other executable scripts to be written into a web-accessible directory under the theme path.

An attacker sends a crafted multipart HTTP POST request directly to the vulnerable endpoint. The server writes the supplied file to disk under the theme's upload location. The attacker then requests the uploaded file via its public URL, triggering PHP execution under the web server account.

This class of flaw provides direct code execution without prior access. It bypasses the WordPress role and capability model entirely because the endpoint never invokes WordPress authentication checks.

Root Cause

The root cause is the absence of server-side validation in the theme's file upload logic. The handler does not verify user identity, enforce current_user_can() capability checks, validate nonces, or reject dangerous file extensions such as .php, .phtml, or .phar. Combined with a writable, web-accessible target directory, this produces an unauthenticated arbitrary file upload condition.

Attack Vector

Exploitation requires only network access to the WordPress site. No credentials, user interaction, or prior foothold are required. The attacker issues an HTTP POST to the vulnerable upload endpoint with a malicious payload, then accesses the resulting file URL to execute code. Public proof-of-concept material is referenced in Exploit-DB #51969 and the VulnCheck Advisory on Travelscape.

No verified exploitation code is reproduced here. Refer to the linked advisories for technical request details.

Detection Methods for CVE-2024-58349

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files within wp-content/themes/travelscape/ and its subdirectories.
• HTTP POST requests to theme upload endpoints originating from unauthenticated sessions or unusual IP ranges.
• Outbound connections from the web server process (php-fpm, apache2, www-data) to attacker-controlled infrastructure shortly after file upload events.
• New cron jobs, scheduled tasks, or modifications to wp-config.php following suspicious upload activity.

Detection Strategies

• Monitor file system events for new executable script files created under the Travelscape theme directory.
• Inspect web server access logs for POST requests targeting theme-level upload handlers from unauthenticated clients.
• Correlate file creation events with subsequent GET requests to the same path, indicating webshell execution.
• Apply WAF rules to flag multipart uploads carrying PHP content-type or PHP magic bytes destined for theme paths.

Monitoring Recommendations

• Enable file integrity monitoring across wp-content/themes/ and alert on any write to executable file types.
• Forward web server, PHP, and WordPress audit logs to a centralized analytics platform for retention and correlation.
• Baseline outbound network connections from web server processes and alert on deviations.

How to Mitigate CVE-2024-58349

Immediate Actions Required

• Remove or disable the Travelscape 1.0.3 theme until a verified patched version is available.
• Audit the theme directory and broader WordPress filesystem for unauthorized PHP files and remove any webshells.
• Rotate WordPress administrator credentials, database passwords, and any secrets stored in wp-config.php if compromise is suspected.
• Restrict access to WordPress admin and upload endpoints using IP allowlists or authentication at the reverse proxy layer.

Patch Information

No vendor patch is referenced in the available advisory data. Operators should consult the VulnCheck Advisory on Travelscape for current remediation status and replace the theme if no fix is published.

Workarounds

• Deploy a web application firewall rule that blocks unauthenticated POST requests to Travelscape upload paths.
• Configure the web server to deny PHP execution within wp-content/themes/travelscape/ upload directories.
• Set filesystem permissions to prevent the web server user from writing executable scripts into theme directories.
• Replace the Travelscape theme with a maintained alternative if no patched release becomes available.

# Apache: deny PHP execution within the Travelscape upload directory
# Place this in an .htaccess file inside the vulnerable upload path
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent configuration in the server block
location ~* /wp-content/themes/travelscape/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}