PT-2026-32996 · Owen · Webstack

Chiao-Lin Yu · Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-1555

Mitre

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io img upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1555

Affected Products

Webstack

References · 4

• https://github.com/owen0o0/WebStack/tree/master · Note
• https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5 · Note
• https://twitter.com/0dayPublishing/status/2044263108869230738 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve · Note