CVE-2026-75873
Received Received - Intake

Unauthenticated File Upload in Zella Theme for WordPress

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WPScan

Description
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-75873
EUVD
EUVD-2026-89637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zella_theme zella_theme to 2.6.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Zella Theme for WordPress before version 2.6.3 has a flaw where it does not check user permissions or verify requests for a font upload action. This allows anyone, even without logging in, to upload files including PHP scripts. Attackers could exploit this to run malicious code on the server.

Detection Guidance

Check the installed version of the Zella Theme in your WordPress site. If it is version 2.6.3 or earlier, the system is vulnerable. You can verify this via the WordPress admin panel under Appearance > Themes or by inspecting the theme's files directly.

Impact Analysis

If you use the Zella Theme before 2.6.3, an attacker could upload and execute harmful files on your website. This could lead to complete control of your site, data theft, or further attacks against visitors. The vulnerability is accessible remotely without needing any credentials.

Compliance Impact

This vulnerability could lead to unauthorized file uploads, including malicious PHP files, enabling remote code execution. Such breaches may result in unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Update the Zella Theme to version 2.6.3 or later immediately. If updating is not possible, consider disabling the theme and replacing it with a secure alternative. Additionally, review uploaded files for any suspicious PHP or executable files in the theme's upload directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75873. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart