EUVD-2026-95633
GHSA-wp92-94wv-wf8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin upload endpoint over network
-
DeliverySubmit file with dangerous PHP type
-
ExploitBypass absent file-type restriction
-
ExecutionWeb shell written to webroot
-
PersistRequest shell for code execution
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must have the PX-lab Zombify plugin installed and active at a vulnerable version (up to and including 1.7.7) with its file-upload functionality reachable. The core prerequisite is that the plugin accepts uploaded files without validating/restricting dangerous types (e.g., .php), allowing a web shell to land in a web-accessible path. The supplied CVSS vector indicates no authentication and no user interaction (PR:N/UI:N), so no special configuration is stated as required; however, the primary limiting factor is deployment of this specific, niche plugin, and defenders should confirm whether any authentication level is actually needed, since Patchstack WordPress upload advisories often require low-privilege access despite a PR:N rating. |
| Impact | This is a genuine high-priority issue on affected installations, not merely a high-CVSS-but-low-real-risk case. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability impact and a scope change - consistent with CWE-434 unrestricted file upload leading to web shell deployment and effective remote code execution. However, several signals are MISSING and must temper prioritization: no EPSS score is provided, KEV status is not listed (treat as not-in-KEV), no SSVC decision data is supplied, and no public POC is referenced. The sole source is a single Patchstack advisory. One caveat to verify: Patchstack-reported WordPress arbitrary-upload flaws frequently require at least low-privilege authentication (e.g., subscriber/author), yet this vector asserts PR:N - the PR:N claim should be confirmed against the vendor/Patchstack detail page, because if authentication is actually required the real-world risk drops substantially. The S:C (scope change) rating is plausible for a web shell that pivots from the application to the underlying OS. Net: treat as critical for anyone running Zombify ≤1.7.7 and patch urgently, but the absence of EPSS/KEV/POC means there is no current evidence of mass exploitation. |
| Exploit ScenarioDerived | A remote attacker sends a crafted upload request to the vulnerable Zombify plugin endpoint and uploads a PHP web shell because the plugin does not restrict dangerous file types (CWE-434). With AV:N/AC:L/PR:N/UI:N claimed, the upload requires no user interaction; the attacker then requests the planted file to execute arbitrary code on the web server. No public exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
RemediationAI
No vendor-released patch version is identified in the provided data, so the first action is to deactivate and remove the Zombify plugin until the vendor publishes a fixed release, then track the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve for the patched version and upgrade to it as soon as it is confirmed. If the plugin cannot be removed immediately, disable or otherwise block its file-upload feature and unroute the upload endpoint (for example via a reverse-proxy rule returning 403 for requests to the plugin's upload handler); the trade-off is loss of the plugin's intended functionality. Harden the upload target directory so PHP execution is not permitted - add php_flag engine off / RemoveHandler or equivalent server rules, or set the uploads directory to no-execute - which neutralises a successfully uploaded web shell but can break other plugins that legitimately execute from upload paths. Deploy WAF or application-level rules rejecting multipart uploads containing PHP, phtml, phar and similar extensions or double-extension tricks, accepting that obfuscated payloads may evade signature rules. Finally, because the CVSS vector asserts PR:N while Patchstack WordPress upload advisories often require low-privilege access, audit accounts on affected sites and scan wp-content and upload paths for unexpected PHP files to detect any exploitation that occurred before mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434, Unrestricted Upload of File with Dangerous Type: the plugin's file-upload handling fails to validate or restrict the extension/MIME type of submitted files, so an attacker can place a server-executable file (typically .php) into a directory the web server will serve and interpret. Because WordPress runs on PHP and plugins usually write uploads under wp-content, a successful upload converts directly into remote code execution with the web server's privileges. Scope is marked changed (S:C) in the CVSS vector, consistent with the attacker escaping the vulnerable component's security authority and affecting the underlying host. The CPE cpe:2.3:a:px-lab:zombify:*:*:*:*:*:*:*:* with a wildcard version confirms all releases are treated as in-range up to the stated ceiling of 1.7.7, and the affected component is a third-party WordPress plugin distributed outside WordPress core, so exposure depends entirely on site-specific installation and the reachability of the upload endpoint.
Know when Zombify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable unrestricted upload yielding a web shell gives full C/I/A impact; S:C reflects pivot from the web app to the host OS; PR:N retained per input but flagged as unverified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
Articles & Coverage 1
Executive ViewAI
Organizations running WordPress sites with the PX-lab Zombify plugin (versions up to and including 1.7.7) face a critical risk of full website and server compromise by an unauthenticated attacker. Because no vendor-released patch was identified at time of analysis and no public exploit identified at time of analysis, leadership should immediately verify whether the plugin is deployed and remove or isolate it until a fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or disable the PX-lab Zombify plugin (versions up to and including 1.7.7) if not essential; block execution of PHP and other dangerous file types in WordPress upload and plugin directories; deploy WAF rules to block malicious uploads to Zombify endpoints; restrict access to upload paths; monitor web-accessible directories and logs for unexpected files or upload attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB