What is the CVSS score of CVE-2026-14553?

CVE-2026-14553 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of zportals are affected by CVE-2026-14553?

The zportals WordPress plugin (versions before 6.3.4) contains a remote code execution vulnerability that allows any user with subscriber-level access to upload and execute malicious code on affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14553?

Yes, a public proof-of-concept exploit is available for CVE-2026-14553. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-14553?

Within 24 hours, audit your WordPress environment to identify all instances of the zportals plugin and their current versions; document findings and notify stakeholders of the compromise risk. Within 7 days, upgrade all affected zportals plugin installations to version 6.3.4 or later across development, staging, and production environments, and review recent file upload logs for suspicious activity patterns. Within 30 days, conduct a full security assessment of any installations that were running vulnerable versions, validate that no unauthorized PHP files remain on the server, and implement upload filtering policies to restrict PHP file uploads regardless of declared MIME type.

zportals CVE-2026-14553

EUVD-2026-53115 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-05 WPScan

GHSA-h6gx-qwm9-7g7p

WordPress File Upload RCE PHP Zportals

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-exploitable requiring only Subscriber-level auth (PR:L, AC:L); RCE grants full confidentiality and integrity impact; scope unchanged as impact is contained to the WordPress application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:24 vuln.today

CVSS changed

Aug 05, 2026 - 16:22 NVD

8.1 (HIGH)

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

AnalysisAI

Remote code execution in the zportals WordPress plugin (all versions before 6.3.4) is achievable by any authenticated user holding a Subscriber role or above, exploiting a server-side file upload validation failure that trusts the client-supplied Content-Type header and preserves the original file extension. By uploading a PHP webshell disguised with a benign MIME type, an attacker can plant executable server-side code and gain full control of the WordPress application layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been observed, but the low authentication barrier makes this a genuine risk for sites with open registration.

Technical ContextAI

The zportals WordPress plugin implements a file upload feature that performs client-side MIME validation only, relying on the Content-Type header supplied in the HTTP request rather than independently inspecting the file's magic bytes or enforcing an allowlist of safe extensions server-side. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes this root cause class precisely: the application accepts and stores files whose type it has not verified, then exposes them at a web-accessible path. Because the PHP interpreter on most WordPress hosting environments will execute any .php file placed under the webroot, preserving the original extension is sufficient for weaponization. The affected CPE is cpe:2.3:a:unknown:zportals:*:*:*:*:*:*:*:* covering all versions below 6.3.4 per EUVD-2026-53115. The vulnerability was discovered and reported by WPScan.

RemediationAI

Update the zportals WordPress plugin to version 6.3.4 or later, which contains the vendor-released patch addressing the file upload validation flaw. The fix is confirmed available per vendor and WPScan advisory at https://wpscan.com/vulnerability/02c83708-8f2f-48f8-b73e-df37a42ab360/. If immediate patching is not operationally feasible, the most effective compensating control is to disable WordPress user registration entirely (Settings > General > Membership), which eliminates the ability for unauthenticated parties to self-provision the Subscriber accounts required for exploitation - trade-off being that legitimate self-registration is also blocked. Alternatively, use a WAF rule to block multipart file uploads containing PHP-related extensions (.php, .php3, .php5, .phtml) sent to plugin-specific upload endpoints; note this may break legitimate plugin functionality. Removing the zportals plugin entirely is the most definitive interim control if the feature is non-critical. Server-level mitigation via php_flag engine off in .htaccess for the uploads directory will prevent PHP execution of any uploaded files but may break other plugin upload features site-wide.