CVE-2026-94503 PUBLISHED

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Assigner: Patchstack
Reserved: 21.09.2026 Published: 09.10.2026 Updated: 09.10.2026

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	PX-lab
Product	Zombify
Versions	Default: unaffected affected from 0 to 1.7.7 (incl.)

Credits

Phat RiO | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve

Problem Types

Unrestricted Upload of File with Dangerous Type CWE

Impacts

Upload a Web Shell to a Web Server