{"id":"CVE-2022-0316","aliases":["EUVD-2022-15486","GHSA-j5h9-7hp2-65w5"],"status":"published","title":"Multiple themes - Unauthenticated Arbitrary File Upload","description":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02106,"percentile":0.81882,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2023-01-23T14:48:05Z","modified":"2026-06-17T04:20:22Z","exploits":[{"source":"pocgithub","id":"KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit","title":"KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit","date":"2023-02-08","url":"https://github.com/KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit"}],"products":[{"vendor":"aidreform_project","product":"aidreform"},{"vendor":"chimpgroup","product":"bolster"},{"vendor":"chimpgroup","product":"spikes"},{"vendor":"chimpgroup","product":"westand"},{"vendor":"club-theme_project","product":"club-theme"},{"vendor":"footysquare_project","product":"footysquare"},{"vendor":"pixfill","product":"kings_club"},{"vendor":"soundblast_project","product":"soundblast"},{"vendor":"spikes-black_project","product":"spikes-black"},{"vendor":"statfort_project","product":"statfort"},{"vendor":"unknown","product":"aidreform"},{"vendor":"unknown","product":"bolster"},{"vendor":"unknown","product":"club-theme"},{"vendor":"unknown","product":"footysquare"},{"vendor":"unknown","product":"kingclub-theme"},{"vendor":"unknown","product":"soundblast"},{"vendor":"unknown","product":"spikes"},{"vendor":"unknown","product":"spikes-black"},{"vendor":"unknown","product":"statfort"},{"vendor":"unknown","product":"westand"}],"references":[{"url":"https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0316"},{"url":"https://github.com/advisories/GHSA-j5h9-7hp2-65w5"}],"sources":{"cve":[{"id":"CVE-2022-0316","title":"Multiple themes - Unauthenticated Arbitrary File Upload","description":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.","status":"published","published":"2023-01-23T14:48:05.59Z","modified":"2025-04-03T19:12:48.241Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15486","description":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.","status":"published","published":"2023-01-23T14:48:05Z","modified":"2025-04-03T19:12:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:43.340305Z"}],"ghsa":[{"id":"GHSA-j5h9-7hp2-65w5","title":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme,...","description":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.","status":"published","published":"2023-01-23T15:30:33Z","modified":"2023-02-08T05:07:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:53:59.06921Z"}],"nvd":[{"id":"CVE-2022-0316","description":"The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.","status":"published","published":"2023-01-23T15:15:13.703Z","modified":"2026-06-17T04:20:22.957Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:35.157734Z"}]}}