CVE-2026-14553

Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

Affected

zportals

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/02c83708-8f2f-48f8-b73e-df37a42ab360/

References

• CVE Record
• NVD entry