Ona EUVD-2026-15823

Authenticated user account required on deothemes Ona versions prior to 1.24. Attacker with login credentials can upload malicious files (web shells) to the server without type validation, achieving remote code execution.

This vulnerability carries substantial real-world risk despite the absence of a CVSS score in the submission data. The attack vector is almost certainly network-based with low attack complexity, as file uploads are typically accessible without elevated privileges. CWE-434 vulnerabilities, when combined with web shell upload capability, result in complete system compromise (CVSS Technical Impact: High). The Patchstack reporting source and inclusion in the ENISA EUVD database (EUVD-2026-15823) suggest formal tracking and likely exploitation activity in the wild. No EPSS or KEV data is provided, but the straightforward nature of file upload exploitation—combined with WordPress's ubiquity—indicates this should be treated as a critical priority. This is a high-real-risk issue: file upload RCE vulnerabilities are among the most actively exploited vulnerability classes in WordPress environments, and the presence of a proof-of-concept exploit through Patchstack's vulnerability database increases likelihood of weaponization.

An unauthenticated attacker discovers a WordPress site using the vulnerable Ona theme and navigates to the theme's file upload functionality (likely a form or AJAX endpoint without proper authorization checks). The attacker uploads a PHP web shell file disguised with a double extension (e.g., shell.php.jpg) or a valid image file containing embedded PHP code, exploiting the lack of MIME type validation. Once uploaded to a web-accessible directory, the attacker accesses the shell directly via HTTP, gaining remote code execution and full control of the WordPress site and underlying server. This type of attack requires only network access and can be automated, making it a favorite target for mass-exploitation campaigns targeting WordPress installations.