CVE-2026-1555
CRITICALWebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-1555. PoCs published by Nxploited, willygailo.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-1555, targeting a WordPress vulnerability in the 'img_upload' AJAX action. The script automates the upload of a local file (e.g., shell.php) to multiple targets via a multipart/form-data POST request, leveraging the vulnerable endpoint to achieve remote code execution (RCE).
Description
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (2)
This repository contains a functional exploit for CVE-2026-1555, targeting a WordPress vulnerability in the 'img_upload' AJAX action. The script automates the upload of a local file (e.g., shell.php) to multiple targets via a multipart/form-data POST request, leveraging the vulnerable endpoint to achieve remote code execution (RCE).
This repository contains a functional exploit for CVE-2026-1555, targeting the WebStack WordPress theme. It includes a Python-based exploit script (obfuscated with PyArmor) and a PHP web shell (ms.php) for post-exploitation, indicating a remote code execution (RCE) vulnerability.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H