CVE-2024-58349 describes an arbitrary file upload vulnerability in WP Travel Kit's Travelscape WordPress theme version 1.0.3. The vulnerability arises from inadequate validation of uploaded files, enabling unauthenticated attackers to upload and execute malicious files within the theme directory. This can result in remote code execution, compromising the affected WordPress site. The CVSS 4.0 base score is 9.3 (critical), reflecting the high impact and ease of exploitation without authentication or user interaction. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported as of the published date.

An attacker can upload arbitrary files to the vulnerable WordPress theme directory and execute them, leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress installation, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and consider disabling or removing the Travelscape theme version 1.0.3 if possible. Monitor for vendor updates and apply patches promptly once available.