Cyber Posture

CVE-2026-1555

Critical

Published: 15 April 2026

Published
15 April 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files…

more

on the affected site's server which may make remote code execution possible.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires input validation mechanisms for file uploads to enforce type checking missing in the io_img_upload() function, preventing arbitrary file uploads.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and remediation of flaws like CVE-2026-1555 in the WebStack WordPress theme to eliminate the vulnerability.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on information inputs such as file types at upload boundaries, blocking unauthenticated arbitrary file uploads.

Security SummaryAI

CVE-2026-1555 is a high-severity vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting the WebStack theme for WordPress in all versions up to and including 1.2024. It stems from missing file type validation in the io_img_upload() function, enabling arbitrary file uploads (CWE-434). Published on 2026-04-15, this flaw allows attackers to place malicious files directly on the affected site's server.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By uploading arbitrary files via the flawed upload function, they can potentially achieve remote code execution, granting high-impact confidentiality, integrity, and availability compromises on the target server.

Advisories and references, including the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve) and source code in WebStack's ajax.php (https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5) and repository (https://github.com/owen0o0/WebStack/tree/master), provide details for practitioners to review the issue and implement mitigations such as updating the theme or adding file validation controls.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress theme enables unauthenticated remote exploitation (T1190) and facilitates uploading web shells for RCE (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References