The IT Residence theme for WordPress is susceptible to arbitrary file uploads by authenticated subscribers, which could lead to remote code execution and total system compromise.

The vulnerability is an unrestricted file upload flaw, classified as CWE-434. It permits a user with subscriber-level privileges to bypass intended file type restrictions, facilitating the upload of potentially malicious scripts.

An attacker who successfully exploits this vulnerability can upload and execute arbitrary files, typically leading to remote code execution. This level of access grants the attacker control over the web application, resulting in potential data theft, site defacement, or the use of the server as a pivot point for further network attacks, justifying the critical 9.9 CVSS score.

Immediate Action: Check for theme updates provided by indithemes and apply them immediately. If no update is currently available, temporarily deactivate the theme to mitigate the risk.

Proactive Monitoring: Monitor the uploads directory for suspicious file types or newly created executable files that appear outside of normal operational patterns.

Compensating Controls: Utilize a Web Application Firewall to restrict file uploads and inspect the content-type of incoming requests to prevent malicious payloads.

Public Exploit Available: No

This flaw is critical and requires prompt remediation to prevent unauthorized server access. Administrators should verify the current theme version and apply any available security patches provided by the vendor, while maintaining strict controls on user file upload capabilities.