CVE-2026-94503: critical vulnerability in PX-lab Zombify
WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
Published · Updated
70Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 10epss 0.3%
from disclosure to weapon1 days
Published on NVDOct 9
1st PoC+1d
VulnCheckOct 4
exploitation probability
0.3%top 81% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
PX-lab · Zombifypublic PoCs found — 2
githubgithub.com/Wayang1337/CVE-2026-94503★ 0vulncheckvulncheck.com/xdb/f3375fd1ec4cunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PX-lab Zombify
In the same product, most dangerous first.