What is the CVSS score of CVE-2026-27419?

CVE-2026-27419 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Zegen Theme are affected by CVE-2026-27419?

The Zegen WordPress theme (versions 1.1.9 and earlier) contains a critical vulnerability allowing any subscriber-level user to upload and execute arbitrary code, enabling complete site takeover and…

How to fix or mitigate CVE-2026-27419?

Within 24 hours: Identify all WordPress installations running Zegen theme versions 1.1.9 and earlier; immediately disable the theme on all affected sites pending remediation. Within 7 days: Restrict file upload permissions to Administrator role only; deploy Web Application Firewall rules blocking PHP file uploads and executable extensions; implement automated scanning and quarantine for all user-uploaded files. Within 30 days: Install a patched version when released (monitor Patchstack security advisories and vendor channels), or replace the theme entirely with a maintained alternative; conduct forensic file integrity review to identify any unauthorized executable uploads that may have occurred.

Zegen Theme CVE-2026-27419

EUVD-2026-41333 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-02 Patchstack

GHSA-qf93-7g5p-rgxj

File Upload Zegen WordPress Wordpress Theme

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable upload endpoint (AV:N/AC:L), requires a Subscriber account (PR:L), no interaction; upload-to-RCE crosses into the server context (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:00 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

AnalysisAI

Arbitrary file upload in the Zegen WordPress theme (versions 1.1.9 and earlier) lets a low-privileged authenticated user (Subscriber role) upload files without adequate type validation, enabling upload of executable PHP and full site compromise. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a minimally-privileged account can escalate to server-level code execution. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Zegen is a commercial WordPress theme published by ZOZOThemes (CPE cpe:2.3:a:zozothemes:zegen). The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: a theme-provided upload handler is reachable by users holding only the Subscriber capability and fails to properly restrict the extension, MIME type, or content of uploaded files. In WordPress themes this typically stems from an AJAX or form endpoint that writes attacker-controlled files into a web-accessible directory (e.g. wp-content/uploads) without allowlisting safe types, so a .php payload can be written and then requested directly to execute in the site's PHP context.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to a fixed release once ZOZOThemes publishes one beyond 1.1.9 - consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/zegen/vulnerability/wordpress-zegen-theme-1-1-9-arbitrary-file-upload-vulnerability) for the fixed version. As immediate compensating controls: disable open user registration (Settings > General, uncheck 'Anyone can register') to remove the Subscriber attack path, at the cost of blocking legitimate self-signup; deploy a WAF virtual patch (Patchstack or equivalent) to filter the vulnerable upload endpoint; and harden the uploads directory to deny PHP execution (e.g. an .htaccess/nginx rule blocking execution of .php under wp-content/uploads), noting this can break plugins that legitimately serve dynamic files from that path. Audit existing users and the uploads directory for unexpected accounts or planted scripts before and after remediation.