CVE-2026-1555: WebStack WordPress Theme - Unauthenticated Arbitrary File Upload
CVE-2026-1555 affects the WebStack theme for WordPress, where missing file type validation in the io_img_upload() function allows unauthenticated users to upload arbitrary files, per the record's description. The CNA Wordfence rates it critical with a CVSS 3.1 base score of 9.8, and the record notes that remote code execution may be possible. No confirmed exploitation appears in the sources consulted, and the record contains no fixed version.
Overview
CVE-2026-1555 is a file upload weakness in the WebStack theme for WordPress, tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type). According to the record, the io_img_upload() function does not validate file types, so the flaw is reachable without authentication in all versions up to and including 1.2024.
Impact
- The CVSS 3.1 vector reported by Wordfence (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability.
- The record states that uploading arbitrary files may make remote code execution possible on the server.
- The SSVC data in the record marks the issue as automatable with total technical impact.
Affected products and versions
- Product: Owen WebStack (WordPress theme).
- Affected versions: up to and including 1.2024, as listed in the record.
- No fixed version is listed in the record. The absence of a fixed version does not confirm that a fix is unavailable; the reviewed sources do not state one.
Exploitation status
CISA KEV does not list this CVE, so no active exploitation is confirmed by that catalog. The EPSS probability is 0.00984 (percentile 0.61341) as recorded. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify any site running the WebStack theme and check its installed version against the affected range.
- Monitor the vendor and the Wordfence advisory for an updated release or fixed version, since the record does not provide one.
- Until a fix is confirmed, consider restricting or disabling the theme on exposed sites, and review whether the upload functionality can be limited through server-side controls such as strict allowlisting of file types and storage outside executable web paths.
- Remove unused themes and keep WordPress core and plugins current.
Detection guidance
- Review web server and WordPress logs for unexpected POST requests to upload-related endpoints from unauthenticated sources.
- Look for newly created files with executable or script extensions in upload and theme directories, and for unfamiliar files in the web root.
- Monitor for unexpected outbound connections or new scheduled tasks originating from the web server process.
Limitations of the available information
- The record does not identify the exact fixed version, and no patch is cited.
- The record does not describe the upload path, accepted parameters or exact file locations, and these details are intentionally omitted here.
- The CVE was published on 2026-04-15 and its status is recorded as Deferred, so information may change.
- Whether a given installation is exploitable depends on its configuration, which the record does not describe.
Frequently asked questions
What is CVE-2026-1555?
It is an unauthenticated arbitrary file upload weakness in the WebStack WordPress theme, caused by missing file type validation in the io_img_upload() function, affecting versions up to and including 1.2024.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record does not list a fixed version. The absence of one in the record does not confirm that no fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.