zportals subscriber uploads permit remote code execution
zportals before 6.3.4 trusts the client-supplied content type for an uploaded file and preserves its original extension. Any authenticated user, including a Subscriber, can therefore upload a PHP file that may execute under the web server and provide remote code execution. This unscored record received deeper review because a low-privilege arbitrary-file-upload primitive can lead directly to code execution. The CNA does not disclose the endpoint, action, upload field or destination directory.
- Component
- zportals
- Plugin slug
zportals- Affected
- < 6.3.4
- Safe version
6.3.4- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update zportals to 6.3.4 or later. Inspect upload locations for unexpected executable files and review Subscriber accounts and web-server process activity if a vulnerable version was installed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N