CVE-2026-40749: WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the Charity Zone WordPress theme (versions 1.1.1 and earlier). The flaw is reachable over the network and requires only a low-privilege account (subscriber level) to exploit, with no user interaction needed. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected environment, including the ability to upload and execute arbitrary code. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from any internet-accessible host without needing local or physical access.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrative credentials are needed, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No user interaction is required; the attacker can complete the exploit entirely without any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker can upload and execute arbitrary server-side code, gaining a persistent foothold on the web server.
• Full contents of the web application, including stored credentials, user data, and configuration files, become readable to the attacker.
• An attacker can modify or delete any files and database records accessible to the web server process.
• The scope is changed (S:C), meaning the impact can extend beyond the WordPress installation itself to other services or containers sharing the host environment.