Is CVE-2026-40749 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40749 being exploited in the wild.

How severe is CVE-2026-40749?

Critical severity, with a CVSS score of 9.9, published 17 June 2026.

Which products and versions are affected?

Themagnifico52 Charity Zone <= 1.1.1.

Is there a fix for CVE-2026-40749?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40749 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40749?

Check whether you run Themagnifico52 Charity Zone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40749: themagnifico52 Charity Zone arbitrary file upload

Q: Is there a fix for CVE-2026-40749?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-40749 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-40749?

Check whether you run Themagnifico52 Charity Zone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40749 · Severity: critical · CVSS 9.9 · Published 2026-06-17

Charity Zone, a WordPress theme designed for charitable organizations, contains a security flaw that allows registered users with low-level 'Subscriber' permissions to upload malicious files. An attacker could use this to upload a 'backdoor' script, granting them full control over the website. This could lead to the theft of donor data, website defacement, or the complete shutdown of the organization's online presence.

Vendors: Themagnifico52.

Quick answers

Is CVE-2026-40749 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40749 being exploited in the wild.
How severe is CVE-2026-40749?: Critical severity, with a CVSS score of 9.9, published 17 June 2026.
Which products and versions are affected?: Themagnifico52 Charity Zone <= 1.1.1.
Is there a fix for CVE-2026-40749?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40749 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40749?: Check whether you run Themagnifico52 Charity Zone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Charity Zone theme for WordPress (versions 1.1.1 and below) suffers from an unrestricted file upload vulnerability (CWE-434). The flaw allows an authenticated attacker with Subscriber-level privileges to upload files of dangerous types, such as PHP scripts, to the web server. This occurs due to insufficient validation of file extensions or content during the upload process. Successful exploitation enables remote code execution (RCE), allowing the attacker to compromise the underlying server or the WordPress environment. The issue is addressed in version 1.1.2.

Affected products

themagnifico52 Charity Zone <= 1.1.1

Timeline

2026-02-22: other: Vulnerability reported by Denver Jackson
2026-04-20: advisory: Patchstack published advisory
2026-06-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.