What is the CVSS score of CVE-2026-40748?

CVE-2026-40748 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Kids Gift Shop are affected by CVE-2026-40748?

The Kids Gift Shop WordPress theme (versions 0.5.4 and earlier) contains a critical vulnerability enabling any authenticated Subscriber-level user to upload arbitrary files and achieve remote code…

How to fix or mitigate CVE-2026-40748?

Within 24 hours: Identify all WordPress instances running Kids Gift Shop theme version 0.5.4 or earlier; audit and disable Subscriber-level user accounts without documented business justification. Within 7 days: Deactivate the vulnerable theme and migrate to an alternative theme from a vendor with active security updates; contact Kids Gift Shop vendor to confirm patch timeline and subscribe to security advisories. Within 30 days: Conduct forensic audit of wp-content/uploads and server file system for unauthorized files created since theme deployment; implement PHP execution prevention in upload directories via web server or .htaccess configuration; enforce file type whitelisting in WordPress upload handlers.

Kids Gift Shop CVE-2026-40748

EUVD-2026-37600 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-17 Patchstack

File Upload Kids Gift Shop

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable WordPress endpoint with only Subscriber auth (PR:L), no user interaction, and arbitrary file upload yielding RCE that escapes the theme's security scope (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:15 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

AnalysisAI

Arbitrary file upload in the Kids Gift Shop WordPress theme (versions 0.5.4 and earlier) allows authenticated users with Subscriber-level privileges to upload arbitrary files to the server. The CVSS 3.1 score of 9.9 with scope change reflects the potential for remote code execution leading to full site compromise, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Kids Gift Shop WordPress theme by themagnifico52, identified by CPE cpe:2.3:a:themagnifico52:kids_gift_shop. CWE-434 (Unrestricted Upload of File with Dangerous Type) is the root cause class - a file upload handler in the theme fails to properly validate file extensions, MIME types, or content, allowing executable PHP files to be written into web-accessible directories. WordPress themes that expose AJAX endpoints or admin-ajax handlers without proper capability checks frequently exhibit this pattern, where the nopriv or low-privilege hook is accessible to any logged-in user including Subscribers, the lowest authenticated WordPress role typically granted via open registration.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists versions <= 0.5.4 as affected without referencing a fixed release. Site operators should immediately deactivate and remove the Kids Gift Shop theme from any production WordPress installation until the vendor publishes a patched version, monitoring https://patchstack.com/database/wordpress/theme/kids-gift-shop/vulnerability/wordpress-kids-gift-shop-theme-0-5-4-arbitrary-file-upload-vulnerability for updates. As compensating controls, disable open user registration in WordPress general settings to eliminate the Subscriber-account attack surface (side effect: blocks legitimate self-service signups), enforce a Web Application Firewall rule blocking POST requests to the theme's upload endpoints (side effect: may break legitimate theme features), and restrict PHP execution within wp-content/uploads via webserver configuration (side effect: breaks plugins that rely on uploads-directory execution).