CVE-2026-56059: WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the PhysCode Travel Booking WordPress theme, versions 2.2.5 and earlier. The flaw is reachable over the network and requires only a low-privilege account (subscriber level) with no victim interaction needed, making it trivially exploitable by any registered user. Successful exploitation allows an attacker to upload and execute arbitrary code on the server, giving full control over confidentiality, integrity, and availability with scope extending beyond the theme itself. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrative credentials are needed, but the attacker must have at least one valid registered-user account on the target site.

• Victim interactionNot required

  No victim action is needed; the attacker submits the malicious file upload request directly without relying on social engineering or user clicks.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race-condition, memory-layout, or other environmental prerequisites.

Blast Radius

• Attacker uploads and executes a web shell or arbitrary PHP file, gaining remote code execution on the underlying server.
• Full contents of the WordPress database (user credentials, customer records, booking data) become readable and exfiltrable.
• Attacker can modify or delete any files accessible to the web server process, including theme files, plugins, and uploaded media.
• The scope extends beyond the WordPress application itself: other services and data on the same host or container are reachable from the attacker-controlled process.