High CVSS 8.1
CVE-2026-14553
NVD analysis in progress
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read sensitive data and modify or destroy data.
- Weakness
- Upload accepts a dangerous file type, often one the server will execute.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.