Description

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-20T12:16:37.440Z",
  "pubdate": "2026-08-20T12:16:37.440Z",
  "executiveSummary": "An arbitrary file upload vulnerability has been identified in the Warehouse Cargo application affecting versions 2.6.9 and prior. This security flaw permits authenticated users with subscriber-level privileges to upload arbitrary files to the underlying server hosting the vulnerable application. The primary impact of this vulnerability includes potential remote code execution, unauthorized system access, and complete compromise of the web application integrity. The affected systems are WordPress installations utilizing the Warehouse Cargo plugin or theme. The risk implications are critical, as successful exploitation allows low-privileged malicious actors to bypass security controls, upload malicious payloads such as web shells, and execute arbitrary code within the context of the web server user. Attacker capabilities are constrained only by the privileges of the web application process once exploitation succeeds. The primary requirement for exploitation is authenticated access with subscriber-level privileges, enabling attackers to interact with vulnerable upload endpoints or functionality lacking proper input validation, file type restriction, and extension sanitization.",
  "technicalDetails": "The vulnerability resides in the file handling and upload mechanisms of the Warehouse Cargo plugin or theme, specifically affecting versions 2.6.9 and below. The root cause of the flaw stems from insufficient validation and sanitization of user-supplied file uploads, as well as inadequate enforcement of file extension restrictions. Specifically, the vulnerable component fails to adequately verify MIME types, check magic bytes, or restrict uploaded file extensions to safe formats, allowing users to supply executable scripts.\nThe exploitation method requires an attacker to authenticate to the application using a low-privileged subscriber account. Upon authentication, the attacker interacts with vulnerable upload functionality exposed by Warehouse Cargo. The attack flow proceeds as follows: First, the attacker crafts a multipart HTTP POST request containing a malicious payload, such as a PHP web shell, disguised as an allowed file type or directly exploiting the lack of extension filtering. Second, the attacker transmits this payload to the vulnerable endpoint over the network. Third, the application processes the upload without enforcing strict validation checks and stores the malicious file within a publicly accessible directory on the web server file system.\nThe network exposure of this vulnerability is tied to the accessibility of the web application, allowing remote exploitation over HTTP or HTTPS once valid subscriber credentials are obtained. Privilege requirements are limited to authenticated subscriber-level access, meaning an attacker does not require administrative or high-level privileges to initiate the attack. The payload behavior involves the storage of executable code on the server filesystem. Post-exploitation impact includes arbitrary code execution, lateral movement within the hosting environment, data exfiltration, and potential persistence mechanisms established by the attacker via the newly uploaded web shell. Because the application fails to restrict the destination path or sanitize the filename, attackers may also achieve directory traversal or overwrite critical application files depending on the implementation details of the upload handler."
}