Description

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-06T09:17:49.427Z",
  "pubdate": "2026-10-06T09:17:49.427Z",
  "executiveSummary": "The Doctreat theme for WordPress, in versions 1.7.0 and below, contains a critical security vulnerability involving an unauthenticated arbitrary file upload flaw.\nThe vulnerability originates from insufficient validation of user-supplied files within the theme's upload functionality. An unauthenticated remote attacker can exploit this to bypass security controls and upload malicious files, such as PHP web shells, directly to the web server.\nSuccessful exploitation allows for remote code execution, granting the attacker the ability to execute arbitrary commands, compromise sensitive data, manipulate the database, or achieve full system takeover.\nThis vulnerability poses an extreme risk as it does not require prior authentication, allowing exploitation by any external party with network access to the affected site. The impact includes total site compromise and potential lateral movement within the hosting environment.",
  "technicalDetails": "The vulnerability resides within the file upload mechanism utilized by the Doctreat theme. The root cause is a failure to implement server-side validation regarding the file type, extension, or content of uploaded files before storing them in an accessible directory on the server.\nBecause the theme lacks robust sanitization and file extension checking, it fails to enforce a whitelist of permitted file formats. Consequently, an attacker can submit a multipart/form-data request containing a malicious payload, such as a crafted PHP script, disguised as or appended to legitimate upload requests.\nThe attack flow begins with the attacker identifying the endpoint responsible for handling theme-related file uploads. Without requiring authentication, the attacker submits an HTTP POST request to this endpoint, injecting a malicious executable file. The server processes the request and saves the file to a publicly accessible directory, typically within the theme's upload path or the WordPress 'wp-content/uploads' directory.\nOnce the file is successfully uploaded, the attacker can execute the code by navigating directly to the file's URL path. The web server interprets and executes the malicious script under the context of the web server user. This interaction bypasses the intended functionality of the application, effectively granting the attacker remote code execution (RCE) capabilities.\nThe exposure is global, meaning any host running Doctreat 1.7.0 or earlier is susceptible if the vulnerable upload functionality is exposed to the internet. No specific user privileges are required for exploitation, as the vulnerable functions are accessible to unauthenticated visitors.\nPost-exploitation, the attacker has the ability to deploy further backdoors, exfiltrate the WordPress configuration file (wp-config.php) containing database credentials, or modify the underlying application logic. The lack of integrity checks on uploaded content serves as the primary vector for this compromise, emphasizing a total breakdown in the theme's input validation layer."
}