PT-2026-1265 · WordPress · Themify Shopo

Published 2026-01-05 · Updated 2026-01-10 · CVE-2025-31048

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Themify Shopo versions through 1.1.4

Description The software is susceptible to an unrestricted file upload issue, allowing the upload of files with dangerous types, such as web shells, to a web server. Successful exploitation could lead to remote code execution. The vulnerability requires low-privilege authentication.

Recommendations Versions prior to 1.1.4 should be updated.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-31048

Affected Products

Themify Shopo

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-31048 · Security Note
• https://twitter.com/cracbot/status/2009943373655036227 · Twitter Post
• https://twitter.com/CveFindCom/status/2008141258909196659 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008151272999079941 · Twitter Post
• https://patchstack.com/database/wordpress/theme/shopo/vulnerability/wordpress-shopo-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/wordpress/theme/shopo/vulnerability/wordpress-shopo-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/0dayPublishing/status/2008126614815514837 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/shopo/vulnerability/wordpress-shopo-1-1-4-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/41368 · Telegram Post
• https://twitter.com/CVEnew/status/2008129292006281635 · Twitter Post