CVE-2026-1555 - Vulnerability Analysis

Overview

WebStack WordPress theme <= 1.2024 contains an unrestricted file upload vulnerability caused by missing file type validation in io_img_upload() function, letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Update to a version later than 1.2024 or the latest available version.

References

• https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5
• https://github.com/owen0o0/WebStack/tree/master
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner