Threats affecting pkg:github/owen0o0/WebStack

The Owen WebStack WordPress theme contains a critical vulnerability (CVE-2026-1555) due to missing file type validation in the io_img_upload() function. This flaw allows unauthenticated attackers to upload arbitrary files to the affected server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.2024. No official patch or remediation guidance has been provided yet. The CVSS score is 9.8, indicating a critical severity level.