CVE-2026-75873CWE-434unrestricted-file-upload

CVE-2026-75873

Critical · published September 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00569 · 46.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-30T10:17Z
References (1)
https://wpscan.com/vulnerability/15b8a6cb-f89c-4d4d-9812-441e822c647f/ · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 30 SEP 06:00Z
    Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
    cvelistv5