EUVD-2026-63318
GHSA-mvqg-5pvw-g7jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account
-
DeliveryAuthenticate to WordPress
-
ExploitPOST web shell to theme upload handler
-
ExecutionBypass missing file-type validation
-
PersistAccess uploaded PHP in web root
-
ImpactExecute code as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated WordPress account at subscriber level or higher (CVSS PR:L), reachable over the network with no user interaction. The practical enabling condition is that the target site allows account access - most impactful where WordPress open user registration is enabled, letting an attacker self-provision the needed subscriber account; sites that disable registration and tightly control accounts substantially limit exploitation. The affected software must be the Warehouse Cargo theme at version 2.6.9 or earlier and active on the site. No specific non-default theme feature is named in the advisory beyond the vulnerable upload handler shipped with the theme. |
| Impact | This is a genuine high-priority issue rather than a paper-tiger high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) indicates network-reachable, low-complexity exploitation needing only subscriber-level authentication and no user interaction, with full confidentiality/integrity/availability impact and a scope change - the classic profile of an authenticated-to-RCE web flaw. The main mitigating factor is the PR:L requirement: an attacker needs a valid registered account, so sites that allow open user registration (WordPress's default 'Anyone can register' setting) are far more exposed than those that don't. EPSS was not provided and there is no KEV listing or known public POC, so exploitation probability is presently unquantified; the absence of a POC should not be read as safety given how mechanically simple CWE-434 exploitation is once the endpoint is known. Any operator running an affected version with open registration should treat this as urgent and patch promptly. |
| Exploit ScenarioDerived | An attacker registers a subscriber account on a Warehouse Cargo site that permits self-registration, then sends a crafted request to the theme's file-upload handler containing a PHP web shell disguised or unfiltered by type checks. Because no user interaction or higher privilege is needed, the shell lands in a web-accessible directory and the attacker browses to it to run arbitrary code as the web server user. No public POC is currently identified, but the low complexity makes independent exploit development straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Update Warehouse Cargo to a release later than 2.6.9 once the vendor publishes one; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/warehouse-cargo/vulnerability/wordpress-warehouse-cargo-theme-2-6-9-arbitrary-file-upload-vulnerability) is the authoritative source for the patched version, which is not independently confirmed in the data provided here, so verify the exact fix release with the vendor before relying on it. As immediate compensating controls, disable open user registration (uncheck 'Anyone can register' under Settings > General) to remove the subscriber attack surface, since PR:L exploitation depends on an attacker holding an account; deploy a WAF or WordPress virtual patch (Patchstack/Wordfence) to block the theme's upload endpoint; harden the uploads directory to deny PHP execution (e.g. an .htaccess/nginx rule preventing execution under wp-content/uploads), noting this may break legitimate features that rely on served scripts; and audit existing uploads and user accounts for signs of prior abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Warehouse Cargo, a commercial WordPress theme published by TheMagnifico (CPE cpe:2.3:a:themagnifico52:warehouse_cargo). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): a theme-provided upload handler fails to validate file type, extension, or content, so an attacker can place executable PHP into a web-accessible path. In WordPress theme contexts these handlers are typically AJAX actions or form endpoints exposed to any logged-in user; because the theme runs inside the WordPress PHP process, an uploaded script executes with the web server's privileges, which is why CVSS marks scope changed (S:C) and all three impacts High.
Know when Warehouse Cargo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity upload handler needing only a subscriber account (PR:L, no UI); unrestricted upload yields RCE across the WordPress host, so scope changes and C/I/A are all High.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
Executive ViewAI
Warehouse Cargo WordPress theme versions 2.6.9 and earlier contain a critical arbitrary file upload vulnerability that allows subscriber-level users to execute remote code and fully compromise WordPress servers. Organizations using this theme face immediate risk of data exfiltration, site defacement, and use as a malware distribution platform.
Restrict subscriber account permissions to disable or prevent file uploads entirely; implement mandatory file type whitelisting (whitelist-only approach) blocking all executable file extensions; configure web server to block .php and script execution in upload directories via .htaccess or server configuration; set upload directory with read-only permissions for the web server process; implement file integrity monitoring and intrusion detection for unexpected executable file creation; deploy network segmentation limiting subscriber access to critical infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB