A vulnerability has been reported in multiple WPScientist themes for WordPress, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the valums_uploader/php.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerability is reported in the following themes:
* Lightspeed version 1.1.2
* Eptonic version 1.4.3
* Nuance version 1.2.3

Solution
No official solution is currently available.

Provided and/or discovered by
JingoBD

Original Advisory
http://packetstormsecurity.com/files/119241/WordPress-Valums-Uploader-Shell-Upload.html

Deep Links
Links available to Secunia VIM customers