CVE-2023-54352Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
7 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
Disclosure: 5 classified signals
Peaked 2d ago at 5 mentions (2026-06-08); latest day: 1
7 total mentions across 3 days

Deep dive

Activity timeline7 mentions / 3d

Signal classification2 categories

Disclosure

571.4%

Patch

228.6%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-08	5	Disclosure4Patch1
2026-06-10	1	Patch1
2026-06-14	1	Disclosure1

Full discourse7 posts

SecAlerts@SecAlertsCo130d
Disclosure
🧩 CVE-2023-54352: Critical unauthenticated RCE in WordPress Seotheme. No login needed — attackers upload malicious PHP files straight to the theme directory. CVSS 9.3. Remove or replace this theme immediately. #WordPress #cybersecurity https://secalerts.co/vulnerability/CVE-2023-54352 https://t.co/LFGZJUBCwo
Post summary
The tweet discloses a critical unauthenticated RCE in WordPress Seotheme (CVE‑2023‑54352) with CVSS 9.3, and urges users to remove or replace the theme as a mitigation.
0000075
835 followersView on X
DFIR Lab@DFIR_Lab134d
Patch
🚨 CRITICAL: CVE-2023-54352 (CVSS 9.8) WordPress Seotheme theme allows unauthenticated RCE via malicious file upload. Attackers gain full system access. AFFECTED: WordPress Seotheme theme ACTION: Remove theme immediately #CVE #Vulnerability #PatchNow https://t.co/Q81HR10Wrq
Post summary
WordPress Seotheme theme is vulnerable to unauthenticated RCE through file uploads; users are advised to remove the theme right away. No PoC, exploit code, or active exploitation is reported.
0000040
43 followersView on X
ADK Cyber@ADKCyber136d
Patch
CVE-2023-54352 (CVSS 9.8): remote code execution flaw in WordPress Seotheme. Organizations using this theme should verify updates and apply them promptly. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/rBwL6UuTe7
Post summary
The tweet announces CVE‑2023‑54352, a high‑severity remote code execution flaw in WordPress Seotheme, and urges users to verify updates and apply them promptly.
0000039
91 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2023-54352 WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to … https://www.cve.org/CVERecord?id=CVE-2023-54352 ----- Traducción: CVE-2023-54352 Wor… http://infoflow.cloud`
Post summary
The post announces CVE-2023-54352 as a remote code execution flaw in WordPress Seotheme, describing how unauthenticated attackers can upload malicious files to execute arbitrary PHP code, but provides no PoC, exploit code, or active exploitation evidence.
0000029
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2023-54352 WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to … https://www.cve.org/CVERecord?id=CVE-2023-54352
Post summary
The tweet announces CVE-2023-54352 as an unauthenticated RCE vulnerability in WordPress Seotheme, explaining that attackers can upload malicious PHP files to execute code.
00000169
57.6K followersView on X
ThreatCluster@threatcluster136d
Disclosure
Two unauthenticated remote code execution flaws in WordPress Augmented-Reality and Seotheme plugins, tracked as CVE-2023-54350 and CVE-2023-54352, allow arbitrary PHP uploads and execution, according to VulnCheck. https://threatcluster.io/cluster/critical-remote-code-execution-vulnerabilities-in-wordpress--3d89352f
Post summary
Two unauthenticated RCE flaws in WordPress plugins (CVE-2023-54350 and CVE-2023-54352) have been disclosed, allowing arbitrary PHP uploads and execution. No PoC, exploit code, active exploitation, or patch information is provided.
0000065
317 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2023-54352 Remote Code Execution in WordPress Seotheme via Unauthenticated Malicious File Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2023-54352
Post summary
The snippet announces a remote code execution vulnerability in WordPress Seotheme tied to unauthenticated file uploads, without providing PoC, exploit code, or mitigation instructions.
0000043
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2023-54352

DFIR Lab[verified]@DFIR_LabPatch

WordPress Seotheme theme is vulnerable to unauthenticated RCE through file uploads; users are advised to remove the theme right away. No PoC, exploit code, or active exploitation is reported.

ADK Cyber[verified]@ADKCyberPatch

The tweet announces CVE‑2023‑54352, a high‑severity remote code execution flaw in WordPress Seotheme, and urges users to verify updates and apply them promptly.

ThreatCluster[verified]@threatclusterDisclosure

Two unauthenticated RCE flaws in WordPress plugins (CVE-2023-54350 and CVE-2023-54352) have been disclosed, allowing arbitrary PHP uploads and execution. No PoC, exploit code, active exploitation, or patch information is provided.

SecAlerts@SecAlertsCoDisclosure

The tweet discloses a critical unauthenticated RCE in WordPress Seotheme (CVE‑2023‑54352) with CVSS 9.3, and urges users to remove or replace the theme as a mitigation.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2023-54352 as a remote code execution flaw in WordPress Seotheme, describing how unauthenticated attackers can upload malicious files to execute arbitrary PHP code, but provides no PoC, exploit code, or active exploitation evidence.

CVE@CVEnewDisclosure

The tweet announces CVE-2023-54352 as an unauthenticated RCE vulnerability in WordPress Seotheme, explaining that attackers can upload malicious PHP files to execute code.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The snippet announces a remote code execution vulnerability in WordPress Seotheme tied to unauthenticated file uploads, without providing PoC, exploit code, or mitigation instructions.