What is the CVSS score of CVE-2026-1555?

CVE-2026-1555 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1555?

WebStack WordPress theme versions through 1.2024 contain a critical remote code execution vulnerability in the image upload function that allows unauthenticated attackers to upload and execute…

How to fix or mitigate CVE-2026-1555?

24 hours: Identify all WordPress installations using WebStack theme versions 1.2024 or earlier and disable the affected io_img_upload() function or remove the theme entirely if not essential. 7 days: If WebStack theme removal is not feasible, implement web application firewall (WAF) rules to block file upload requests to the vulnerable upload endpoint and restrict file upload directories from executing PHP code. 30 days: Transition to an alternative WordPress theme with active security maintenance, or contact WebStack developers for patched version availability and upgrade immediately upon release.

WordPress CVE-2026-1555

EUVD-2026-22830 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-15 Wordfence

GHSA-5c49-p8m3-fjh3

WordPress RCE File Upload

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 04:06 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 04:00 euvd

EUVD-2026-22830

Analysis Generated

Apr 15, 2026 - 04:00 vuln.today

CVE Published

Apr 15, 2026 - 03:37 nvd

CRITICAL 9.8

DescriptionCVE.org

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Unrestricted file upload in WebStack WordPress theme allows unauthenticated remote code execution. The io_img_upload() function in all versions through 1.2024 lacks file type validation, enabling unauthenticated attackers to upload malicious files (e.g., PHP shells) directly to the server. No public exploit identified at time of analysis, but EPSS score and attack complexity (CVSS AC:L) indicate straightforward exploitation. Critical severity (CVSS 9.8) warranted due to complete system compromise potential with zero authentication barriers.

Technical ContextAI

WebStack is a WordPress theme for creating navigation/link directory sites. The vulnerability resides in the io_img_upload() function within inc/ajax.php, which handles file uploads without validating file extensions or MIME types. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) implementation flaw. In WordPress environments, uploaded PHP files can be executed directly by the web server if placed in accessible directories, bypassing application-level security. The affected CPE (cpe:2.3:a:owen:webstack) indicates this is a third-party theme, not an official WordPress.org repository theme, which may limit automatic update mechanisms and increase exposure windows for vulnerable installations.

RemediationAI

Immediately upgrade WebStack theme to a patched version beyond 1.2024 when available, or remove the theme entirely if not business-critical. As of analysis time, no vendor-released patch version is confirmed from available data; monitor the official GitHub repository at https://github.com/owen0o0/WebStack for updates. Interim mitigation: implement web application firewall (WAF) rules blocking POST requests to /wp-content/themes/webstack/inc/ajax.php, restrict file upload functionality at the web server level (disable PHP execution in upload directories via .htaccess or nginx config), and conduct immediate file system audit for suspicious uploads (unexpected .php, .phtml, .php5 files in wp-content/uploads or theme directories). Organizations unable to patch immediately should strongly consider switching to an alternative maintained WordPress theme with active security support. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570 for detection indicators.