Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-75873

Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 2.6.3
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Affected versions

  • Unknown Zella Theme

    fixed in 2.6.3

References 1

wpscan.com