The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| statfort_project | statfort | - |
| aidreform_project | aidreform | - |
| club-theme_project | club-theme | - |
| soundblast_project | soundblast | - |
| chimpgroup | bolster | - |
| pixfill | kings_club | - |
| chimpgroup | westand | * |
| footysquare_project | footysquare | - |
| spikes-black_project | spikes-black | - |
| chimpgroup | spikes | - |