CVE-2026-75873

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
UnknownZella Theme< 2.6.3

References

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-7587410.0Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, FiCVE-2026-758759.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.CVE-2026-758766.3A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionaCVE-2026-758779.9A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SysteCVE-2026-758789.1IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper auCVE-2026-758794.3IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send aCVE-2026-75885.3A vulnerability was found in ggerve coding-standards-mcp. This issue affects the function get_style_guide/get_best_practices of the file serCVE-2026-758806.5An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation durinCVE-2026-758817.5IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an inCVE-2026-758828.5An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissCVE-2026-758836.8A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a speciaCVE-2026-758849.1A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccoun
CVE-2026-75873: Critical severity, CVSS 9.8 | Vulnix