CVE-2026-14553— Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14553
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
ZPortals 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZPortals是ZPortals公司的一款内容管理系统的组件。 ZPortals 6.3.4之前版本存在安全漏洞，该漏洞源于未正确验证上传的文件，信任客户端提供的内容类型并保留原始文件扩展名，导致任何已认证用户能够上传任意PHP文件并实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-14553
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14553
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14553 (1)
- 🔗 Zportals < 6.3.4 – Subscriber+ Arbitrary File Upload | CVE 2026-14553 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-05 · 24 CVEs total
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR | |
| CVE-2026-16573 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload | |
| CVE-2026-16602 | Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure | |
| CVE-2026-16583 | Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-16561 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure | |
| CVE-2026-16603 | Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure | |
| CVE-2026-16736 | User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registrati | |
| CVE-2026-16613 | GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF | |
| CVE-2026-16604 | Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Co | |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commission | |
| CVE-2026-16605 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing | |
| CVE-2026-16940 | Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path T | |
| CVE-2026-16055 | Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_log | |
| CVE-2026-16993 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Up | |
| CVE-2026-16968 | GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users | |
| CVE-2026-16942 | WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS | |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | |
| CVE-2026-15210 | Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeov | |
| CVE-2026-15230 | YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclo | |
| CVE-2026-15372 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side R - CVE-2026-19074
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticat - CVE-2026-19089
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticat - CVE-2026-19077
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post D - CVE-2026-15047
s2Member < 260805 - Contributor+ Stored XSS via Shortcode
V. Comments for CVE-2026-14553
No comments yet