CVE-2026-14553

The CVE concerns the zportals WordPress plugin prior to 6.3.4, where uploaded files are not properly validated (trusting client-supplied content type and keeping the original extension). This allows any authenticated user (Subscriber or higher) to upload arbitrary PHP files, enabling remote code ...