CVE-2026-27419: WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the Zegen WordPress theme versions 1.1.9 and earlier. The flaw is reachable over the network and requires only a low-privilege subscriber-level account, meaning any registered user on an affected WordPress site can exploit it. Successful exploitation allows an attacker to upload and execute arbitrary files on the server, resulting in full remote code execution, complete data access, and the ability to disrupt or take over the affected environment. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege subscriber-level account is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  No action from any other user or administrator is needed to complete the attack.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• An attacker uploads a malicious file (such as a PHP web shell) and achieves remote code execution on the host running WordPress.
• With code execution, the attacker reads all data stored in the WordPress database, including user credentials, session tokens, and customer records.
• The attacker can modify or delete any files and database rows accessible to the web server process.
• The attacker can crash or disable the WordPress service entirely, causing a full outage of the affected site.