CVE-2026-40747: WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the WordPress Ecommerce Zone theme at version 0.9.7 and earlier. The flaw is reachable over the network and requires only a low-privilege account (subscriber level), with no victim interaction needed, giving authenticated attackers the ability to upload arbitrary files to the server. Successful exploitation enables full remote code execution, complete data disclosure, data tampering, and service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account such as a subscriber-level WordPress user is sufficient to trigger the upload functionality; no administrative rights are needed.

• Victim interactionNot required

  The attacker can exploit this vulnerability entirely without any action from another user or administrator.

• Attack complexityDetail

  The exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker uploads a malicious file (such as a PHP web shell) and executes arbitrary operating system commands on the host running WordPress.
• Confidential data stored in the WordPress database and filesystem, including customer records, payment details, and credentials, is readable by the attacker.
• The attacker can modify or delete database rows, theme files, and uploaded content, corrupting the storefront and persisted application data.
• The attacker can crash or render the WordPress service unavailable by overwriting critical files or exhausting server resources through uploaded payloads.