What is the CVSS score of CVE-2026-40746?

CVE-2026-40746 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Restaurant Zone are affected by CVE-2026-40746?

The Restaurant Zone WordPress theme (versions 0.7.8 and earlier) contains a critical vulnerability allowing users with Subscriber-level site access to upload and execute malicious code, resulting in…

How to fix or mitigate CVE-2026-40746?

Within 24 hours: Audit all WordPress instances for Restaurant Zone theme presence; immediately deactivate and remove the theme; revoke or restrict file upload permissions from Subscriber user role via WordPress capability settings. Within 7 days: Replace with an actively maintained WordPress theme with established security track record; restore from clean backups if signs of compromise are detected (unauthorized files, new admin accounts, anomalous uploads). Within 30 days: Implement file upload scanning and validation; deploy Web Application Firewall rules to monitor and block suspicious uploads to wp-content/uploads and plugin directories; conduct forensic review of user activity logs on affected systems.

Restaurant Zone CVE-2026-40746

EUVD-2026-37598 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-17 Patchstack

WordPress File Upload Restaurant Zone Wordpress Theme Themagnifico52

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable WordPress endpoint (AV:N), no special timing (AC:L), Subscriber account required (PR:L), no admin interaction (UI:N); webshell escapes WordPress sandbox to OS (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:16 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

AnalysisAI

Arbitrary file upload in the Restaurant Zone WordPress theme through version 0.7.8 allows authenticated attackers with only Subscriber-level privileges to upload arbitrary files to the underlying server, leading to remote code execution and full site compromise. The CVSS 3.1 score of 9.9 reflects the scope-changing impact achievable from a minimally privileged account; no public exploit is identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

Restaurant Zone is a commercial WordPress theme distributed by themagnifico52 (CPE cpe:2.3:a:themagnifico52:restaurant_zone) targeted at restaurant and food-service sites. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): a theme-exposed upload handler is reachable to users holding the WordPress Subscriber role - the lowest authenticated tier, granted to anyone who can register - and fails to validate file type, extension, or MIME before writing the file into a web-accessible location under wp-content. Because WordPress executes PHP files placed inside its document root, dropping a .php payload through such a handler converts a file write primitive directly into code execution under the web server account.

RemediationAI

No vendor-released patch identified at time of analysis - the input data provides no fixed version, only an upper-bound affected range of <= 0.7.8 via Patchstack (https://patchstack.com/database/wordpress/theme/restaurant-zone/vulnerability/wordpress-restaurant-zone-theme-0-7-8-arbitrary-file-upload-vulnerability). Until themagnifico52 ships a fixed release, the most effective compensating control is to deactivate and replace the Restaurant Zone theme, which will break the site's current presentation layer but eliminates the vulnerable code path entirely. If removal is not acceptable, disable open user registration (Settings > General > 'Anyone can register' unchecked) to remove the Subscriber prerequisite - note this blocks legitimate self-service signups; additionally, place a WAF rule or web-server deny rule blocking POST requests to the theme's upload endpoint and forbid execution of PHP inside wp-content/uploads via an .htaccess or nginx location block, accepting that any plugin that legitimately writes PHP there will break. Audit wp-content/uploads and the theme directory for unexpected PHP, .phtml, .phar, or double-extension files written since the theme was installed.