CVE-2026-75873

— UNSCORED

Published 2026-09-30 · Updated 2026-09-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

All references

https://wpscan.com/vulnerability/15b8a6cb-f89c-4d4d-9812-441e822c647f/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.