Description
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Published: 2026-04-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Arbitrary File Upload leading to potential Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the WebStack WordPress theme where the io_img_upload() function fails to validate uploaded file types. An attacker can upload any file, including code, which may then be executed on the server, compromising confidentiality, integrity, and availability of the site.

Affected Systems

The issue affects the WebStack theme from Owen, impacting all released versions up to and including 1.2024. WordPress sites using this theme are therefore at risk.

Risk and Exploitability

This flaw carries a CVSS score of 9.8 and is marked as not listed in the CISA KEV catalog. The exploit does not require authentication and can be carried out from any unprivileged network location, making the attack vector accessible to any internet-facing attacker. Opportunity for exploitation is high, and the lack of an availability or isolation countermeasure increases the potential impact.

Generated by OpenCVE AI on April 15, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WebStack theme to a version newer than 1.2024 or replace it with a secure alternative
  • Ensure that the upload endpoint enforces strict MIME‑type checks and only allows approved file extensions
  • Configure the upload directory to reside outside of the web root and remove execute permissions on that directory
  • Deploy a Web Application Firewall or similar security layer to block suspicious upload attempts

Generated by OpenCVE AI on April 15, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Owen
Owen webstack
Wordpress
Wordpress wordpress
Vendors & Products Owen
Owen webstack
Wordpress
Wordpress wordpress

Wed, 15 Apr 2026 04:00:00 +0000

Type Values Removed Values Added
Description The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Title WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Owen Webstack
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-15T15:53:23.768Z

Reserved: 2026-01-28T17:18:24.254Z

Link: CVE-2026-1555

cve-icon Vulnrichment

Updated: 2026-04-15T15:52:30.345Z

cve-icon NVD

Status : Deferred

Published: 2026-04-15T04:17:33.600

Modified: 2026-04-22T20:23:16.350

Link: CVE-2026-1555

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T14:53:32Z

Weaknesses