CVE-2026-75873

The Zella Theme WordPress theme, in versions before 2.6.3 , is vulnerable to unauthenticated arbitrary file upload . The root cause is the lack of capability or nonce checks on a specific font upload action accessible to unauthenticated users. This allows attackers to upload arbitrary files, such...

EUVD-2026-89637

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...