Warehouse Cargo
Monthly
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.