A vulnerability has been patched in a popular WordPress theme called Neosense that allows an attacker to upload code without authentication.