This vulnerability (CVE-2026-40747) affects themagnifico52 Ecommerce Zone versions up to 0.9.7 and involves unrestricted file upload by subscribers. The flaw allows attackers with subscriber-level privileges to upload files of dangerous types, potentially leading to full system compromise. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with subscriber privileges to upload arbitrary files, which can lead to full compromise of the affected system's confidentiality, integrity, and availability. This may enable remote code execution, data theft, or denial of service depending on the uploaded file and system configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber permissions where possible and monitor for suspicious file uploads. Avoid relying on this vulnerability being mitigated without vendor confirmation.