CVE-2026-40748: Kids Gift Shop Path Traversal Flaw

CVE-2026-40748 Overview

CVE-2026-40748 is an arbitrary file upload vulnerability affecting the Kids Gift Shop WordPress theme in versions up to and including 0.5.4. The flaw allows authenticated users holding only Subscriber-level privileges to upload arbitrary files to the WordPress server. Successful exploitation enables attackers to place executable scripts within the web root, leading to remote code execution and full site compromise. The weakness maps to CWE-434: Unrestricted Upload of File with Dangerous Type. The issue is tracked publicly through the Patchstack WordPress Vulnerability Database.

Critical Impact
A Subscriber-level account can upload PHP web shells, achieve remote code execution, and fully compromise the WordPress site and underlying host.

Affected Products

Kids Gift Shop WordPress theme versions <= 0.5.4
WordPress installations with the Kids Gift Shop theme active
WordPress sites permitting Subscriber-level registration with this theme enabled

Discovery Timeline

2026-06-17 - CVE-2026-40748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40748

Vulnerability Analysis

The Kids Gift Shop theme exposes a file upload handler that fails to validate the authenticated caller's role and the uploaded file's type. Any user with a Subscriber account, the lowest authenticated WordPress role, can invoke the handler. The handler accepts arbitrary file extensions, including PHP, and writes them to a web-accessible directory. The attacker then requests the uploaded script through the browser to execute code in the context of the web server.

The scope change reflected in the vulnerability metrics indicates that exploitation extends beyond the vulnerable theme itself. A successful upload gives the attacker control over the entire WordPress installation, the database credentials stored in wp-config.php, and any data accessible to the PHP process. EPSS currently estimates a 0.434% probability of exploitation within 30 days, but the low privilege requirement and trivial complexity make this theme a high-value target on sites with open user registration.

Root Cause

The root cause is missing authorization and missing file-type validation in the theme's upload endpoint [CWE-434]. The handler does not call current_user_can() against an appropriate capability such as upload_files, and it does not enforce a server-side allowlist of MIME types or extensions. WordPress nonce verification, if present, does not substitute for capability checks.

Attack Vector

The attack vector is network-based and requires only a Subscriber account. The attacker registers on the target site, authenticates, and sends a crafted multipart POST request to the theme's vulnerable upload endpoint with a PHP payload. The server stores the payload in the uploads directory, and the attacker retrieves it via a direct HTTP GET request to trigger execution.

No verified public proof-of-concept code is available at this time. Refer to the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2026-40748

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar in wp-content/uploads/ directories created after theme installation
New or unexpected Subscriber accounts followed by POST requests to theme AJAX or admin-ajax endpoints
Outbound connections from the PHP worker process to attacker-controlled infrastructure after an upload event
Modifications to wp-config.php, .htaccess, or core WordPress files inconsistent with administrator activity

Detection Strategies

Inspect web server access logs for POST requests to Kids Gift Shop theme paths originating from non-administrative accounts
Audit WordPress user tables for recently registered Subscriber accounts and correlate against upload events
Hash and baseline files under wp-content/uploads/ and alert on new PHP-executable content
Deploy file integrity monitoring across the WordPress document root

Monitoring Recommendations

Forward web server, PHP-FPM, and WordPress audit logs to a centralized log platform for correlation
Alert on wp-content/uploads/**/*.php request patterns at the WAF or reverse proxy layer
Monitor process lineage from the web server user spawning shells such as sh, bash, python, or nc
Track creation of cron entries, scheduled tasks, or new system users following web request activity

How to Mitigate CVE-2026-40748

Immediate Actions Required

Deactivate and remove the Kids Gift Shop theme on all WordPress sites running version 0.5.4 or earlier until a patched release is verified
Disable open user registration or restrict the default new-user role away from Subscriber where business requirements permit
Block direct execution of PHP files inside wp-content/uploads/ at the web server configuration layer
Audit existing accounts and remove any unrecognized Subscriber-level users

Patch Information

At the time of publication, no fixed version is referenced in the available advisory data. Monitor the Patchstack advisory for updates and apply the vendor patch as soon as it is released.

Workarounds

Place a web server rule denying execution of .php, .phtml, and .phar files within wp-content/uploads/
Deploy a WordPress security plugin or Web Application Firewall with virtual patching coverage for this CVE
Require email verification and CAPTCHA on registration to slow automated account creation
Restrict access to theme upload endpoints by IP allowlist where feasible

bash

# Nginx: block PHP execution under wp-content/uploads/
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}