Zella Theme CVE-2026-75873

Exploitable against default installations of any WordPress site using the Zella Theme prior to version 2.6.3 - the vulnerable font upload action is exposed to unauthenticated users and performs no capability or nonce check, so no login, user interaction, or non-default configuration is required (consistent with AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment scope: only sites actively running this specific commercial theme in a version below 2.6.3 are affected; sites updated to 2.6.3 or later are not exploitable. Successful RCE also requires that the upload destination be web-accessible and that PHP execution not be blocked in that directory by server hardening.

This is a genuine high-priority vulnerability, not a paper-tiger high-CVSS case. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is well-supported by the description: an unauthenticated, network-reachable font upload action performs no capability or nonce check and permits upload of arbitrary files including PHP, yielding remote code execution. SSVC reinforces this - Technical Impact 'total' matches C:H/I:H/A:H, and Automatable 'yes' means the flaw can be reliably scripted and mass-scanned, which is typical for unauthenticated WordPress file-upload bugs. The mitigating signals are exploitation-status related: SSVC Exploitation is 'none', there is no CISA KEV listing, no EPSS score was provided in the input, and no public POC is indicated, so no active exploitation is confirmed at this time. However, the combination of PR:N + AC:L + CWE-434 to PHP + Automatable:yes makes this the kind of bug that is quickly weaponized once details circulate (WPScan has published an advisory). Priority should be treated as HIGH for any site running the affected Zella Theme, tempered only by the product's likely modest deployment footprint. No conflicting signals were detected between the CVSS vector and the description - both point to unauthenticated remote RCE.

A remote, unauthenticated attacker sends a crafted POST request to the theme's unprotected font upload endpoint, supplying a malicious PHP file instead of a font. Because no capability or nonce check is enforced, the file is written into a web-accessible directory, and the attacker then requests that PHP file to execute arbitrary code (a webshell) on the server. No public POC or exploit code is identified at time of analysis, but the attack is straightforward and SSVC marks it Automatable:yes.