CVE-2026-22327: WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the Restaurt WordPress theme (versions 1.0.4 and earlier), allowing a network-accessible attacker with only a subscriber-level account to upload arbitrary files to the server. Subscriber-level accounts are the lowest tier of WordPress authentication, meaning the barrier to exploitation is exceptionally low. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system, including the ability to execute code remotely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege subscriber-level WordPress account is sufficient; no administrative access is needed, but some form of valid login is required.

• Victim interactionNot required

  The attacker can upload a malicious file without any action from another user or administrator.

• Attack complexityDetail

  The exploit is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• An attacker uploads and executes a web shell or malicious script, achieving remote code execution on the host running WordPress.
• All files and data readable by the web server process are exposed, including database credentials, configuration secrets, and stored user data.
• An attacker can modify, overwrite, or delete theme files, plugins, and content, defacing the site or embedding persistent backdoors.
• The web server process can be disrupted or the host destabilized, taking the WordPress site offline.