External risk intelligence

Wastia Theme Unrestricted File Upload Web Shell Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-49060

The vulnerability affects a WordPress theme, which are commonly deployed as part of public-facing web applications. Because these themes run on web servers accessible via the internet to serve content to users, the file upload functionality is often reachable by external actors, making it a likely component of an internet-facing attack surface.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Wastia theme that could allow an attacker to upload malicious files to a web server, potentially leading to unauthorized control. This issue could impact any deployment of the affected theme.

Allows dangerous file uploads.
Enables web server compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Wastia theme's file upload feature directly over the internet, without needing any special access or credentials. Once this feature is reached, the attacker can upload a dangerous file type, like a web shell, to the web server. The vulnerability can then allow the uploaded web shell to run, potentially leading to a complete compromise of the server.

No special access needed.
Uploading a dangerous file type.
Web server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to upload a web shell to a web server, potentially leading to server compromise. This could occur when the application is configured to allow file uploads without sufficient validation of file types.

Web server file upload functionality at risk.
Malicious files could be uploaded via upload feature.
Remote code execution and server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the CMSSuperHeroes Wastia theme, allowing for unrestricted file uploads that can lead to web shell deployment, likely impacts teams responsible for managing public-facing web applications, including platform and application owners. The initial priority should be to identify all instances of the affected theme, assess their exposure and business criticality, and then coordinate with the theme's vendor or an internal development team to plan remediation.

Identify responsible application owners.
Verify theme deployment and reachability.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wastia theme used in WordPress?

Wastia is a WordPress theme by CMSSuperHeroes designed to manage the visual presentation and layout of websites built on the WordPress platform. Themes like Wastia control how content is displayed to visitors, often incorporating functional components to handle user-submitted data, such as file upload features, which interact directly with the underlying web server.

What does CWE-434 mean regarding CVE-2025-49060?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the Wastia theme fails to properly inspect or limit the types of files users can upload. Because the system does not enforce strict validation, it allows the storage of executable files, such as web shells, that can bypass security controls and grant unauthorized access.

How does an attacker trigger this file upload vulnerability?

An attacker triggers this flaw by interacting with the theme's upload functionality to submit a malicious script. Crucially, this does not require administrative privileges or prior authentication; the server accepts the dangerous file due to the lack of validation. Simply uploading standard, safe image files or interacting with non-uploading parts of the site will not trigger the vulnerability.

Is my instance of Wastia at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your WordPress site is internet-facing. Because Wastia themes are typically used to serve content publicly, the vulnerable upload component is often reachable by any external user. If your site is accessible from the internet, you should assume the component is exposed to potential unauthorized file uploads.

Do I need to update my Wastia theme?

Yes, updating is the primary defense. If you are running any version of Wastia below 1.1.3, you are using affected software. Your first step should be to locate every installation of this theme within your environment, evaluate if it is exposed to the internet, and then apply the vendor-provided patch to ensure file types are properly restricted.

References

patchstack.com/database/Wordpress/Theme/wastia/vulnerability/wordpre…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.