VulnSocial

CVE-2024-58349Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 7 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 7 signals
  • Disclosure: 5 classified signals
  • Peaked 3d ago at 4 mentions (2026-06-08); latest day: 1
  • 7 total mentions across 4 days

Deep dive

Activity timeline7 mentions / 4d
01234Mentions · 2026-06-08: 4Mentions · 2026-06-09: 1Mentions · 2026-06-10: 1Mentions · 2026-06-13: 1Patch / Workaround · 2026-06-08: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-06-13: 1Technical Details · 2026-06-08: 4Technical Details · 2026-06-09: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-13: 106-0806-0906-1006-13
Signal classification2 categories
Disclosure
571.4%
Patch
228.6%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-084
Disclosure3Patch1
2026-06-091
Disclosure1
2026-06-101
Patch1
2026-06-131
Disclosure1
Full discourse7 posts
  • SecAlerts@SecAlertsCo
    Disclosure

    🧳 CVE-2024-58349: WordPress Travelscape theme 1.0.3 has a critical (CVSS 9.3) unauthenticated arbitrary file upload flaw. No login required to drop malicious files on your server. Disable or update the theme immediately. #WordPress #cybersecurity https://secalerts.co/vulnerability/CVE-2024-58349 https://t.co/usVCVbVdWp

    Post summary

    The tweet announces a critical unauthenticated file‑upload vulnerability in WordPress Travelscape 1.0.3 (CVE‑2024‑58349), urging users to disable or update the theme.

    0000156
    835 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2024-58349 (CVSS 9.8) WordPress Travelscape Theme 1.0.3 - Unauthenticated arbitrary file upload leads to RCE. No authentication required. Patch immediately if using this theme. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/3f8o8autoe

    Post summary

    CVE‑2024‑58349 is a critical flaw in WordPress Travelscape Theme 1.0.3 that allows unauthenticated arbitrary file upload leading to remote code execution; users are urged to apply the patch immediately.

    0000051
    43 followersView on X
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs
    Disclosure

    CVE-2024-58349 (WordPress Travelscape theme). If the vulnerable upload endpoint is reachable, unauthenticated attackers may upload dangerous files and potentially achieve RCE. See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-08/TIER_2_CVE-2024-58349.md #CyberSecurity #DPI #WordPress #WebSecurity #RCE

    Post summary

    The post announces CVE‑2024‑58349 affecting the WordPress Travelscape theme, noting that an unauthenticated upload endpoint could lead to remote code execution, with additional details provided in an external analysis report.

    0000028
    51 followersView on X
  • NerdieNews@NewsNerdie
    Patch

    🔴 CVE-2024-58349 in WordPress Travelscape 1.0.3 lets attackers upload arbitrary files without authentication, enabling remote takeover. Patch immediately or disable the theme—this bypasses all user-level controls. #NerdieNews #CyberSecurity #Ransomware https://t.co/QLwl3L5nLR

    Post summary

    The tweet discloses CVE-2024-58349 in WordPress Travelscape 1.0.3, warns of unauthenticated file upload leading to remote takeover, and urges users to patch or disable the theme.

    0000035
    65 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2024-58349 WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insuff… https://www.cve.org/CVERecord?id=CVE-2024-58349 ----- Traducción: CVE-2024-58349 Wor… http://infoflow.cloud`

    Post summary

    The post reports CVE‑2024‑58349 as an unauthenticated file‑upload flaw in the Travelscape WordPress theme; no PoC, exploit, or patch is disclosed.

    0000025
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2024-58349 WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insuff… https://www.cve.org/CVERecord?id=CVE-2024-58349

    Post summary

    CVE-2024-58349 is an arbitrary file upload flaw in WordPress Theme Travelscape 1.0.3, permitting unauthenticated attackers to upload malicious files. No PoC, exploit, or active exploitation details are provided.

    00000175
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2024-58349 Arbitrary File Upload and Remote Code Execution in WordPress Theme Travelscape 1.0.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58349

    Post summary

    The brief note announces CVE-2024-58349 as an arbitrary file upload leading to remote code execution in the WordPress theme Travelscape 1.0.3.

    0000039
    4.0K followersView on X

Explore more

Back to dashboard