The AI Hub WordPress theme by LiquidThemes contains an unrestricted file upload vulnerability (CWE-434) due to lack of proper file type validation in the generate_image function. This flaw allows unauthenticated attackers to upload arbitrary files, which could be leveraged to execute remote code on the server hosting the vulnerable theme. The vulnerability affects all versions up to and including 1.3.7. It has a CVSS 3.1 base score of 9.8, reflecting its critical severity and ease of exploitation over the network without privileges or user interaction.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the affected server. This compromises confidentiality, integrity, and availability of the system running the vulnerable WordPress theme. The critical CVSS score (9.8) underscores the severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable functionality, disable or remove the AI Hub theme if not necessary, and monitor for suspicious file uploads. Applying general WordPress security best practices may help reduce risk but do not replace the need for a vendor-provided patch.