A critical vulnerability in the WebStack theme for WordPress allows unauthenticated attackers to execute arbitrary code on the host server.

This is an unrestricted file upload vulnerability (CWE-434) within the io_img_upload() function. The lack of file type validation allows unauthenticated remote attackers to upload malicious scripts directly to the server.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows full system compromise without user interaction or authentication. Successful exploitation grants an attacker the ability to execute remote code, leading to complete data exfiltration, site defacement, or the establishment of a persistent backdoor within the infrastructure.

Immediate Action: As no official patch is currently available, administrators must immediately deactivate and remove the WebStack theme from all WordPress installations until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at files within the theme's directory structure, particularly those involving file uploads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads to the theme's directory and restrict access to executable scripts in upload folders.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Given the critical CVSS severity and the existence of public proof-of-concept code, this vulnerability poses an immediate threat. Organizations must prioritize the removal of the vulnerable theme immediately. If the theme is business-critical, transition to an alternative solution until the vendor provides a verified security update.