CVE-2026-40749: Charity Zone File Upload Vulnerability

CVE-2026-40749 Overview

CVE-2026-40749 is an arbitrary file upload vulnerability in the Charity Zone WordPress theme, affecting versions up to and including 1.1.1. The flaw allows authenticated users with the low-privilege Subscriber role to upload arbitrary files to the WordPress site. Because the theme does not properly validate uploaded file types, an attacker can place executable PHP files on the server and achieve remote code execution. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated Subscriber can upload web shells to gain remote code execution, fully compromising the underlying WordPress site and its hosting environment.

Affected Products

Charity Zone WordPress theme versions <= 1.1.1
WordPress sites that permit open Subscriber registration and run the vulnerable theme
Hosting environments where the WordPress process can execute uploaded PHP files

Discovery Timeline

2026-06-17 - CVE-2026-40749 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40749

Vulnerability Analysis

The Charity Zone theme exposes a file upload endpoint that is reachable by authenticated users holding the Subscriber role. The handler accepts uploaded files without enforcing an allow-list of safe extensions or validating MIME content. An attacker who registers a free account, or uses any existing Subscriber credentials, can submit a crafted multipart request containing a PHP payload. Once stored under the WordPress uploads directory, the file can be requested over HTTP and executed by the PHP interpreter.

The scope is changed because exploitation grants code execution under the web server account, which typically has write access to plugin, theme, and content directories. This enables persistence, lateral movement, database exfiltration, and pivoting into adjacent tenants on shared hosting. The EPSS probability is approximately 0.434% as of 2026-06-18, but exploitation requires only a registered account, which is common on charity and donation sites that allow self-registration.

Root Cause

The root cause is missing validation of uploaded file extensions and MIME types in the theme's upload handler, combined with a capability check that accepts the Subscriber role instead of restricting uploads to administrators. See the Patchstack advisory for Charity Zone for additional technical context.

Attack Vector

The attack is network-based and requires low privileges and no user interaction. An attacker authenticates as a Subscriber, sends a POST request to the vulnerable theme endpoint with a .php or polyglot file, and then issues a GET request to the resulting upload URL to trigger code execution.

No verified proof-of-concept code is published. See the Patchstack advisory
linked above for additional technical detail on the vulnerable endpoint.

Detection Methods for CVE-2026-40749

Indicators of Compromise

New PHP, .phtml, or .phar files appearing under wp-content/uploads/ or theme directories that were not produced by a known plugin
HTTP POST requests to Charity Zone theme upload endpoints originating from Subscriber-level accounts
Outbound network connections from the php-fpm or web server process to attacker-controlled infrastructure shortly after an upload event
Newly created WordPress accounts that immediately exercise upload functionality

Detection Strategies

Monitor web server access logs for POST requests to theme upload handlers followed by GET requests to .php files inside wp-content/uploads/
Alert on file integrity changes that introduce executable scripts into directories intended to hold static media
Correlate WordPress audit logs of low-privilege user logins with file creation events on the underlying host

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule that blocks uploads containing PHP shebangs, <?php tags, or disallowed extensions
Forward WordPress, PHP-FPM, and web server logs to a central SIEM for correlation across authentication and file system events
Track creation of new Subscriber accounts and flag activity that touches administrative or upload endpoints

How to Mitigate CVE-2026-40749

Immediate Actions Required

Disable or remove the Charity Zone theme until a fixed version is installed
Disable open user registration, or restrict the default new-user role to one without theme upload capabilities
Audit wp-content/uploads/ for unexpected PHP files and remove any web shells discovered
Rotate WordPress administrator passwords and API keys if compromise is suspected

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to 1.1.1 as vulnerable. Site owners should monitor the theme's update channel and apply a vendor-released version above 1.1.1 once available.

Workarounds

Configure the web server to refuse execution of PHP within wp-content/uploads/ using directory-level rules
Deploy a virtual patching rule through a WAF to block uploads with executable extensions to Charity Zone endpoints
Restrict the upload_files capability so it is granted only to Administrator and Editor roles

bash

# Apache: deny PHP execution inside the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}