PT-2026-32996 · WordPress · Webstack

Chiao-Lin Yu · Published 2026-04-15 · Updated 2026-04-30 · CVE-2026-1555

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebStack versions prior to 1.2025

Description The WebStack theme for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This is caused by a lack of file type validation within the io img upload() function, which could lead to remote code execution.

Recommendations Update to a version later than 1.2024. As a temporary workaround, consider disabling the io img upload() function until the update is applied.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1555

Affected Products

Webstack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1555 · Security Note
• https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5 · Note
• https://github.com/owen0o0/WebStack/tree/master · Note
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://twitter.com/0dayPublishing/status/2044263108869230738 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2049791454998917393 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve · Note
• https://twitter.com/CVEnew/status/2044338847233020002 · Twitter Post