This vulnerability (CWE-434) in 8theme XStore Core allows unauthenticated attackers to upload files without proper restriction on file types. The affected versions include all versions up to 5.3.8. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No patch or official remediation level has been disclosed by the vendor or in the advisory. The vulnerability is publicly known as of May 17, 2024.

An attacker can upload files with dangerous types to the affected XStore Core installations, which may lead to denial of service or other availability impacts. There is no reported confidentiality impact, but integrity impact is low. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality through configuration or web application firewall rules if possible to limit dangerous file types. Monitor vendor communications for updates on patches or official mitigations.