CRITICAL 9.8 CVE-2026-75873 Published 30 Sept 2026

Zella WordPress Theme Arbitrary File Upload RCE Vulnerability

Worried this affects your website?

Get Emergency Help help@myserverhacked.com

The Zella Theme WordPress theme before version 2.6.3 does not perform any capability or nonce check on one of its font upload actions.

This action is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Reference: CVE-2026-75873 on NVD

← Back to Security News