CVE-2026-40746: WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the Restaurant Zone WordPress theme (versions 0.7.8 and earlier), reachable over the network by any authenticated subscriber-level user. An attacker with a low-privilege WordPress account can upload malicious files, such as server-side scripts, to the target host without restriction. Successful exploitation enables full remote code execution, complete data disclosure, data tampering, and service disruption. No upstream fix has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS traffic.

• AuthenticationRequired

  A low-privilege WordPress account (subscriber role or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim interaction is required; the attacker sends the malicious file upload request directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental prerequisites.

Blast Radius

• Attacker uploads a server-side script (such as a PHP webshell) and executes arbitrary commands on the hosting server.
• Full contents of the WordPress database become readable, including user credentials, session tokens, and any stored customer or order data.
• Attacker can overwrite, delete, or inject content into any file the web server process has write access to, including theme and plugin files.
• The hosting environment can be taken fully offline or repurposed as a foothold for lateral movement into adjacent services on the same infrastructure.