The vulnerability CVE-2026-32482 affects deothemes Ona versions before 1.24 and permits an attacker with low privileges to upload files of dangerous types without restriction. This can lead to uploading a web shell, which compromises the web server by allowing remote code execution. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to upload a web shell, resulting in full compromise of the affected web server. This includes complete loss of confidentiality, integrity, and availability of the system hosting deothemes Ona. The vulnerability is critical and could lead to remote code execution and persistent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict file upload permissions and consider disabling file upload functionality if feasible to reduce exposure.