CVE-2026-1555

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Owen	WebStack	<= 1.2024

References

Timeline

Published: Apr 15, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-155504.3The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This i CVE-2026-155515.5Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects .CVE-2026-155526.1Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to i CVE-2026-155535.3Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload CVE-2026-155547.4the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables CVE-2026-155558.8A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshallin CVE-2026-155568.1A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check ca CVE-2026-155577.3A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuth CVE-2026-155586.3A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown fu CVE-2026-155596.3A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineL CVE-2026-15566.5Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows CVE-2026-155608.1when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, al