CVE-2026-1555
Published: 15 April 2026
Summary
CVE-2026-1555 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordfence (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1555 is a high-severity vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting the WebStack theme for WordPress in all versions up to and including 1.2024. It stems from missing file type validation in the io_img_upload() function, enabling arbitrary file uploads (CWE-434). Published on 2026-04-15, this flaw allows attackers to place malicious files directly on the affected site's server.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By uploading arbitrary files via the flawed upload function, they can potentially achieve remote code execution, granting high-impact confidentiality, integrity, and availability compromises on the target server.
Advisories and references, including the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=cve) and source code in WebStack's ajax.php (https://github.com/owen0o0/WebStack/blob/master/inc/ajax.php#L5) and repository (https://github.com/owen0o0/WebStack/tree/master), provide details for practitioners to review the issue and implement mitigations such as updating the theme or adding file validation controls.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22830
Vulnerability details
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files…
more
on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress theme enables unauthenticated remote exploitation (T1190) and facilitates uploading web shells for RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires input validation mechanisms for file uploads to enforce type checking missing in the io_img_upload() function, preventing arbitrary file uploads.
Mandates timely identification, reporting, and remediation of flaws like CVE-2026-1555 in the WebStack WordPress theme to eliminate the vulnerability.
Enforces restrictions on information inputs such as file types at upload boundaries, blocking unauthenticated arbitrary file uploads.