CVE-2026-40750: WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability

Synopsis

An unrestricted file upload vulnerability in the WordPress 'Kids Online Store' theme (versions up to and including 0.8.9) allows an authenticated attacker to upload arbitrary files, including server-side web shells, directly to the web server. The vulnerability is reachable over the network and requires only a low-privilege account, meaning any registered WordPress user can trigger it. Successful exploitation gives an attacker full remote code execution on the hosting server, with high impact to confidentiality, integrity, and availability. No upstream patch has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege WordPress account (such as a subscriber or customer role) is sufficient to trigger the upload; no administrator credentials are needed.

• Victim interactionNot required

  The attacker operates entirely on their own; no other user needs to click a link or perform any action for exploitation to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to reproduce the upload.

Blast Radius

• Attacker uploads a web shell and gains remote code execution on the host server, enabling arbitrary operating-system command execution under the web server process identity.
• All files readable by the web server process are exposed, including WordPress configuration files that contain database credentials and secret keys.
• The attacker can write, modify, or delete any file accessible to the web server, including theme files, plugins, and uploaded customer media.
• The hosting environment can be taken offline entirely by overwriting or deleting critical application files, causing full service disruption for the storefront.