An unrestricted file upload vulnerability in the zozothemes Nutrie WordPress theme allows authenticated attackers to upload web shells and achieve remote code execution.

This vulnerability (CWE-434) stems from improper validation of file types during upload. An attacker with low-level privileges can upload malicious files, such as PHP web shells, to the web server.

The ability to upload arbitrary files to a web server poses a critical risk to organizational security. With a CVSS score of 9.9, this vulnerability can lead to total system compromise, unauthorized access to sensitive application data, and the potential for the server to be used as a staging ground for further network attacks.

Immediate Action: Update the Nutrie theme to version 2.0.1 or later immediately to resolve the file upload validation flaw.

Proactive Monitoring: Audit the WordPress wp-content/uploads directory and subdirectories for any unexpected executable files (e.g., .php, .phtml) that do not belong to legitimate media assets.

Compensating Controls: Ensure that web server configurations restrict the execution of scripts within the uploads directory to prevent the successful execution of uploaded web shells.

Public Exploit Available: Unknown

Administrators must verify the integrity of their WordPress installations and ensure the theme is updated to the patched version 2.0.1. Regular security audits of installed plugins and themes are essential to identify and remediate similar vulnerabilities before they can be exploited.