Arrival

Arrival has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 9.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Missing Authorization, PHP Remote File Inclusion.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, most of them (2) reported by R3N0. Arrival is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSCritical

9.1/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all Arrival vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2025-32921

Arrival <= 1.4.5 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

4 records


2025-04-21 00:00	Arrival <= 1.4.5 - Unauthenticated Local File Inclusion Arrival <= 1.4.5	`CVE-2025-32921`	9.8 Critical	Dimas Maulana	No
2022-01-11 00:00	AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery Arrival <= 1.4.2	`N/A`	8.8 High	R3N0	Yes
2022-01-11 00:00	AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation Arrival <= 1.4.2	`CVE-2022-23975`	8.8 High	R3N0	Yes
2021-10-06 19:17	AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload Arrival <= 1.4.2	`CVE-2021-39317`	8.8 High	Chloe Chamberland	Yes

Showing 1–4 of 4 reports

Latestv1.4.5

Arrival

Author

wpoperations

5.0(2)

100/100

Last Updated

2024-11-12 (2y ago)

Active Installs

100+

Downloads

130,874

Requires WP

4.7+

Requires PHP

5.6+

Created

2019-08-02 (7y ago)

Arrival is complete multipurpose WordPress theme. The theme can be used to create any type of website like corporate, business, portfolio, construction, charity, resturant, landing pages, education, fitness, gym, spa, travel, ecommerce, online stores etc. The theme is lightweight, fast and fully compatible with elementor and other major page builders. The theme comes with fully Gutenberg ready so you are free to edit and publish with new WordPress editor. The theme is a combination of power, freedom, and beauty which means there is no limit of anything you need to create a feature website with your own creative ideas.