CVE-2026-1555 is a critical vulnerability in the Owen WebStack WordPress theme caused by the lack of proper file type validation in the io_img_upload() function. This allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the server hosting the affected theme. The vulnerability affects all versions up to and including 1.2024. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published by the vendor, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict or disable file upload functionality in the WebStack theme if possible, and to monitor for suspicious activity related to file uploads. Consider applying web application firewall (WAF) rules to block malicious upload attempts targeting this vulnerability.