CVE-2026-75873: Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Zella Theme installations running a version earlier than 2.6.3 are affected. The vulnerable font upload action is accessible without authentication.
What does an attacker need to exploit this issue?
An attacker does not need a WordPress account, capabilities, or a valid nonce. They can use the exposed upload action to submit arbitrary files, including PHP files.
What is the likely impact of successful exploitation?
Successful exploitation can allow remote code execution by uploading a PHP file. This could give an attacker the ability to run code on the affected WordPress server.
How can I determine whether my site may be exposed?
Check whether the site uses Zella Theme and whether its version is earlier than 2.6.3. Sites meeting both conditions should be treated as exposed because the affected upload action does not require authentication.