An unauthenticated arbitrary file upload vulnerability in the WebStack WordPress theme allows remote attackers to achieve full site compromise via malicious code execution.

The io_img_upload() function lacks necessary file type validation, enabling an unauthenticated attacker to upload arbitrary files to the server. This flaw facilitates Remote Code Execution (RCE) by allowing the upload and subsequent execution of malicious scripts.

With a CVSS score of 9.8, this vulnerability is critical as it allows complete site takeover without authentication. Successful exploitation can lead to data exfiltration, defacement, and the deployment of persistent backdoors or ransomware within the web server environment.

Immediate Action: Update the WebStack theme to the latest version available; if no patch is available, disable the theme immediately.

Proactive Monitoring: Audit the server's uploads directory for unauthorized or anomalous file types and review web server logs for suspicious POST requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict access to the upload directory.

Public Exploit Available: Unknown

Immediate remediation is required to prevent total site compromise. Administrators should verify the integrity of their WordPress installations and ensure that directory permissions prevent the execution of scripts in upload folders.