Themes Vulnerabilities

Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

Description

The theme does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Proof of Concept

Affects Themes

zella-theme
Fixed in 2.6.3

References

CVE
CVE-2026-75873

Miscellaneous

Original Researcher
Mike Gozdiskowski
Submitter
Mike Gozdiskowski
Verified
Yes
WPVDB ID
15b8a6cb-f89c-4d4d-9812-441e822c647f

Timeline

Publicly Published
2026-09-28 (about 2 days ago)
Added
2026-09-28 (about 1 day ago)
Last Updated
2026-09-29 (about 9 hours ago)

Other

Published
Title
Published
2024-10-04
Title
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress < 6.5.8 - Authenticated (Subscriber+) Limited JavaScript File Upload
Published
2026-02-25
Title
AI Engine < 3.3.3 - Editor+ Arbitrary File Upload
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Published
2023-11-20
Title
CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload
Published
2026-05-18
Title
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload