{"id":"CVE-2026-94503","published":"2026-10-09T10:16:40.607","lastModified":"2026-10-09T18:17:15.677","description":"Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The PX-lab Zombify zombify application allows users to upload files without proper validation, enabling attackers to upload malicious web shells that can execute arbitrary code on the server. This creates a critical remote code execution vulnerability.","exploitability":"The vulnerability is highly exploitable with no prerequisites needed - any authenticated user can upload a web shell file and immediately execute code on the target server.","blast_radius":"An attacker who successfully exploits this vulnerability could gain full control over the web server, potentially leading to data breaches, lateral movement, and complete system compromise.","remediation":"Upgrade to version 1.7.8 or later to remediate this unrestricted file upload vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","rce","upload"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:42:22.812Z"}}