CVE-2026-75873

Name of the Vulnerable Software and Affected Versions Zella Theme versions prior to 2.6.3

Description An unrestricted file upload issue exists in the Zella Theme for WordPress. The software fails to perform capability or nonce checks on a font upload action, which is accessible to unauthenticated users. This allows an attacker to upload arbitrary files, such as PHP scripts, leading to remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Recommendations Update Zella Theme to version 2.6.3 or later.