{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1555", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-28T17:18:24.254Z", "datePublished": "2026-04-15T03:37:20.474Z", "dateUpdated": "2026-04-15T15:53:23.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-15T03:37:20.474Z"}, "affected": [{"vendor": "Owen", "product": "WebStack", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2024", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve"}, {"url": "https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5"}, {"url": "https://github.com/owen0o0/WebStack/tree/master"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "timeline": [{"time": "2026-04-14T14:52:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T15:52:25.867810Z", "id": "CVE-2026-1555", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T15:53:23.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1555", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T15:52:25.867810Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T15:52:30.345Z"}}], "cna": {"title": "WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Owen", "product": "WebStack", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2024"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-14T14:52:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve"}, {"url": "https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5"}, {"url": "https://github.com/owen0o0/WebStack/tree/master"}], "descriptions": [{"lang": "en", "value": "The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-15T03:37:20.474Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1555", "state": "PUBLISHED", "dateUpdated": "2026-04-15T15:53:23.768Z", "dateReserved": "2026-01-28T17:18:24.254Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-15T03:37:20.474Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "id": "CVE-2026-1555", "lastModified": "2026-04-22T20:23:16.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-15T04:17:33.600", "references": [{"source": "security@wordfence.com", "url": "https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5"}, {"source": "security@wordfence.com", "url": "https://github.com/owen0o0/WebStack/tree/master"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.2024]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WebStack", "source": "cna", "vendor": "Owen"}, "product": "webstack", "vendor": "owen"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T05:20:34.549949+00:00", "value": {"mitigation_remediation": ["Update the WebStack theme to a version newer than 1.2024 or replace it with a secure alternative", "Ensure that the upload endpoint enforces strict MIME\u2011type checks and only allows approved file extensions", "Configure the upload directory to reside outside of the web root and remove execute permissions on that directory", "Deploy a Web Application Firewall or similar security layer to block suspicious upload attempts"], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Arbitrary File Upload leading to potential Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects the WebStack theme from Owen, impacting all released versions up to and including 1.2024. WordPress sites using this theme are therefore at risk.", "description_and_impact": "The vulnerability resides in the WebStack WordPress theme where the io_img_upload() function fails to validate uploaded file types. An attacker can upload any file, including code, which may then be executed on the server, compromising confidentiality, integrity, and availability of the site.", "risk_and_exploitability": "This flaw carries a CVSS score of 9.8 and is marked as not listed in the CISA KEV catalog. The exploit does not require authentication and can be carried out from any unprivileged network location, making the attack vector accessible to any internet-facing attacker. Opportunity for exploitation is high, and the lack of an availability or isolation countermeasure increases the potential impact."}}}}, "created": "2026-04-15T13:49:14.869381+00:00", "updated": "2026-04-15T14:53:32.520163+00:00", "vendors": ["owen", "owen$PRODUCT$webstack", "wordpress", "wordpress$PRODUCT$wordpress"]}