CVE-2026-14553highCWE-434

CVE-2026-14553: high-severity vulnerability in zportals

Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload

Published

Follow this CVE+ Monitor zportals

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.1epss 0.6%
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Unknown · zportals
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zportals

In the same product, most dangerous first.

CVE-2026-18365MEDIUMZportals < 6.4.2 - Subscriber+ User Email DisclosureEPSS 0.3%CVE-2026-18364MEDIUMZportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings UpdateEPSS 0.3%