Security
Loading…

CVE-2026-75873

CRITICALCVSS 9.8
View on NVD← Back to search
Description

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Timeline
Published:September 30th, 2026 6:17 AM
Last modified:September 30th, 2026 4:28 PM
CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)
CWE-434
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute