The vulnerability identified as CVE-2026-27043 affects ThemeGoods Photography versions before 7.7.6. It is classified under CWE-434, which involves unrestricted upload of files with dangerous types. This flaw enables an attacker with high privileges to perform path traversal attacks by uploading malicious files, potentially leading to complete system compromise. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker with high privileges to upload files that can traverse directories, potentially overwriting or creating arbitrary files on the server. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary high privileges that could be leveraged to exploit this vulnerability.