The Smart Cleaning theme for WordPress contains an arbitrary file upload vulnerability that enables authenticated subscribers to execute malicious code on the server.

This is an unrestricted file upload vulnerability, CWE-434, which allows an authenticated subscriber to bypass security controls. By uploading dangerous file types, an attacker can gain unauthorized control over the affected WordPress installation.

The ability to upload arbitrary files is a high-risk vector that often results in full remote code execution. Given the 9.9 CVSS score, this vulnerability poses a severe threat to the entire hosting environment, potentially leading to data exfiltration, loss of service, and severe reputational impact for the organization.

Immediate Action: Identify if a security update has been released by themagnifico52 and apply it immediately. If no update exists, consider switching to an alternative, well-maintained theme.

Proactive Monitoring: Inspect the web server's upload directories for unauthorized script files and monitor system logs for unusual file creation events.

Compensating Controls: Configure a Web Application Firewall to block unauthorized file uploads and restrict access to sensitive theme directories.

Public Exploit Available: No

The vulnerability is critical and requires immediate mitigation. Administrators must prioritize checking for official updates from the vendor and implement strict file upload policies to reduce the risk of exploitation until the software is secured.