CVE-2026-94503

CriticalCVSS 10.0

Published: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Summary

The Zombify plugin (up to version 1.7.7) contains an Unrestricted Upload of File with Dangerous Type vulnerability, allowing an attacker to upload a web shell to the web server.

Risk Assessment

An attacker could upload a malicious file and achieve remote code execution, leading to full server compromise.

Recommendation

Update the Zombify plugin to the latest version that fixes the vulnerability. If an update is not possible, consider disabling the plugin until it is patched.

Other vulnerabilities in Zombify

CVE-2025-8385Medium
The Zombify plugin for WordPress up to version 1.7.5 is vulnerable to Path Traversal due to insufficient input validation in the zf_get_file_by_url function. This allows authenticated attackers with subscriber-level access or above to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. Successful exploitation relies on a race condition as the generated file is deleted immediately.

Original NVD description (English source)

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS