CVE-2026-22327: Restaurt Path Traversal Vulnerability

CVE-2026-22327 Overview

CVE-2026-22327 is an arbitrary file upload vulnerability in the Restaurt WordPress theme, affecting versions up to and including 1.0.4. The flaw allows an authenticated user with only Subscriber-level privileges to upload arbitrary files to the WordPress server. Successful exploitation enables an attacker to place a webshell or other executable content within the site's file system, leading to remote code execution and full site compromise. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type and documented in the Patchstack WordPress Vulnerability Advisory.

Critical Impact
Any authenticated Subscriber on a vulnerable site can upload arbitrary files, including PHP webshells, and achieve remote code execution on the underlying WordPress host.

Affected Products

Restaurt WordPress theme versions <= 1.0.4
WordPress sites with open user registration running the vulnerable theme
Any WordPress deployment exposing Subscriber-or-higher accounts on a vulnerable theme installation

Discovery Timeline

2026-06-17 - CVE-2026-22327 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-22327

Vulnerability Analysis

The Restaurt theme exposes a file upload handler that fails to enforce capability checks and file-type restrictions. An attacker authenticated as a Subscriber, the lowest WordPress role, can reach the upload endpoint and submit files with executable extensions such as .php, .phtml, or .phar. The upload routine writes the file into a web-accessible directory under wp-content, allowing the attacker to request the uploaded payload over HTTP and execute it within the WordPress runtime. Because Subscriber accounts are routinely created on sites with open registration, the practical barrier to exploitation is minimal. The change of scope reflected in the CVSS vector indicates that the impact reaches resources beyond the WordPress application itself, including the underlying operating system account that runs PHP.

Root Cause

The root cause is improper validation of uploaded file content and missing authorization checks on the upload action [CWE-434]. The theme does not validate MIME type, extension, or the WordPress capability of the requesting user before persisting the file to disk. There is no allowlist of acceptable file types and no enforcement that the uploader holds the upload_files or edit_posts capability.

Attack Vector

Exploitation requires only a valid Subscriber session and network access to the WordPress site. The attacker authenticates, sends a crafted multipart upload request to the vulnerable theme endpoint, and receives a path to the uploaded file. Requesting that path executes the attacker-supplied PHP code under the web server account. No user interaction from an administrator is needed.

Verified exploitation code is not publicly available. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-22327

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar, .htaccess) inside wp-content/uploads/ or theme directories.
HTTP POST requests to Restaurt theme upload endpoints originating from Subscriber accounts.
New or modified PHP files in web-accessible paths whose modification time does not match a legitimate deployment or update window.
Outbound connections from the web server process to attacker-controlled infrastructure following an upload event.

Detection Strategies

Inspect web server access logs for POST requests to Restaurt theme paths with multipart/form-data content type from low-privilege users.
Hash and baseline files under wp-content/ and alert on additions of executable file types.
Correlate WordPress authentication events for Subscriber accounts with subsequent file write activity on the host.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for retention and correlation.
Enable file integrity monitoring on wp-content/uploads/, wp-content/themes/, and wp-content/plugins/.
Alert on PHP process executions that spawn shells (sh, bash, nc, python) or perform outbound network calls.

How to Mitigate CVE-2026-22327

Immediate Actions Required

Disable or remove the Restaurt theme on any site running version 1.0.4 or earlier until a fixed release is verified.
Disable open user registration, or restrict the default new-user role away from Subscriber, to limit the pool of accounts that can reach the vulnerable endpoint.
Audit wp-content/uploads/ for unexpected PHP files and remove any unauthorized content.
Rotate WordPress administrator credentials and review installed users for unfamiliar accounts.

Patch Information

No vendor-confirmed fixed version is listed in the published advisory at the time of NVD publication on 2026-06-17. Monitor the Patchstack WordPress Vulnerability Advisory for an updated theme release and apply it once available.

Workarounds

Block execution of PHP files within wp-content/uploads/ through web server configuration.
Place a Web Application Firewall (WAF) rule in front of the site to block upload requests to Restaurt theme endpoints from non-administrative users.
Replace the Restaurt theme with a maintained alternative if a patched version is not released.

bash

# Apache: deny PHP execution inside the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent in the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}