CVE-2026-14553

Summary

The flaw allows any authenticated user to upload arbitrary PHP files, leading to remote code execution, due to improper file validation in the zportals WordPress plugin before 6.3.4.

Exploitability

Exploitation is relatively straightforward for any authenticated user (Subscriber or higher) with access to the file upload feature.

Blast radius

If exploited, the impact could be severe, as it allows remote code execution, potentially leading to full control over the affected WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to zportals version 6.3.4 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.