PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-54352 WP Travel Kit CVE debrief

CVE-2023-54352 is a critical remote code execution vulnerability in the WordPress Seotheme plugin. The vulnerability allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access. The vulnerability has a CVSS score of 9.3 and is considered CRITICAL.

Vendor
WP Travel Kit
Product
Travelscape
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the WordPress Seotheme plugin should be aware of this vulnerability and take immediate action to protect themselves.

Technical summary

The vulnerability is caused by a lack of proper validation and sanitization of user-uploaded files, allowing attackers to upload malicious PHP files to the theme directory. The vulnerability can be exploited by unauthenticated attackers, making it a high-risk vulnerability.

Defensive priority

HIGH

Recommended defensive actions

  • Update the WordPress Seotheme plugin to the latest version.
  • Restrict access to the theme directory to prevent unauthorized file uploads.
  • Monitor for suspicious activity and uploaded files to the theme directory.

Evidence notes

The vulnerability was reported by an unknown vendor and has a low confidence level due to limited information.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-54352 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-54352

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-54352 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-54352

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.