CVE-2026-94503: WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The provided vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required. An unauthenticated remote attacker could exploit it.
What is the likely impact of successful exploitation?
The vulnerability allows upload of a dangerous file type, specifically described as a web shell, to the web server. This can lead to remote code execution and high impact to confidentiality, integrity, and availability.
Which versions are affected?
Zombify versions through 1.7.7 are affected. The earliest affected version is not specified.
Is immediate mitigation information available if patching cannot be performed?
No workaround or mitigation is provided in the available data. The issue concerns unrestricted dangerous-file uploads, so exposure should be treated as critical until an update or vendor guidance is available.