CVE-2026-14553
Received Received - Intake

Remote Code Execution in zportals WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: WPScan

Description
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-14553
EUVD
EUVD-2026-53115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zportals zportals_wordpress_plugin to 6.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the zportals WordPress plugin before version 6.3.4. It allows authenticated users with Subscriber-level access or higher to upload arbitrary PHP files due to improper file validation. The plugin does not check the actual content type of uploaded files and keeps the original file extension, which can lead to remote code execution.

Detection Guidance

Check WordPress plugin versions for zportals plugin. If version is below 6.3.4, the system is vulnerable. Look for unexpected PHP files in upload directories or web-accessible locations.

Impact Analysis

An attacker with Subscriber access or higher could upload a malicious PHP file to your WordPress site. If successful, this could allow them to execute arbitrary code on your server, potentially taking control of your website or stealing sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized code execution on a WordPress site, potentially exposing sensitive data. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and user rights. For HIPAA, it could allow unauthorized access to protected health information, leading to compliance breaches and legal penalties.

Mitigation Strategies

Update the zportals WordPress plugin to version 6.3.4 or later immediately. Remove any unauthorized PHP files uploaded to the system. Restrict file upload permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart