The zozothemes Lendiz theme contains a critical unrestricted file upload vulnerability that permits remote attackers to execute arbitrary code by uploading malicious web shells.

The vulnerability is caused by a lack of proper file type validation, allowing users to upload executable files directly to the server. As an unauthenticated vulnerability, it allows any remote attacker to execute commands on the host by accessing the uploaded web shell.

This vulnerability carries a CVSS score of 9.9, indicating an extreme level of risk to the confidentiality, integrity, and availability of the host system. Successful exploitation allows for complete administrative control over the web server, facilitating data theft and the potential for the server to be used as a pivot point for further network infiltration.

Immediate Action: Apply the vendor-provided update to upgrade the Lendiz theme to version 2.0.1 or higher.

Proactive Monitoring: Regularly scan web application directories for unexpected files and monitor server logs for unauthorized POST requests targeting upload functionality.

Compensating Controls: Restrict file permissions on the server to prevent the execution of files within user-uploaded directories and utilize a WAF to block unauthorized file uploads.

Public Exploit Available: Unknown

This is a critical security issue that requires immediate patching to prevent remote exploitation. Organizations using the Lendiz theme should verify their current version and upgrade to 2.0.1 or later as a matter of urgency to mitigate the risk of full system takeover.