The Theme Egg ThemeEgg ToolKit plugin versions up to and including 1.2.9 contain an unrestricted file upload vulnerability that permits an attacker with high privileges to upload malicious files such as web shells to the web server. This vulnerability enables an attacker to execute arbitrary code, leading to full system compromise. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with high privileges to upload arbitrary files, including web shells, resulting in full compromise of the affected web server. This impacts confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high privilege accounts and monitor for suspicious file uploads related to the ThemeEgg ToolKit plugin.