CVE-2026-14553: zportals WordPress Plugin RCE Vulnerability

CVE-2026-14553 Overview

CVE-2026-14553 is an arbitrary file upload vulnerability in the zportals WordPress plugin versions prior to 6.3.4. The plugin fails to validate uploaded files, trusting the client-supplied Content-Type header and preserving the original file extension. Any authenticated user with Subscriber-level access or higher can upload PHP files and achieve remote code execution on the underlying web server. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with minimal privileges can upload and execute arbitrary PHP code, leading to full site compromise.

Affected Products

zportals WordPress plugin versions before 6.3.4
WordPress sites permitting Subscriber registration with the plugin active
Multisite installations exposing the plugin's upload endpoint

Discovery Timeline

2026-08-05 - CVE-2026-14553 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-14553

Vulnerability Analysis

The zportals plugin exposes an authenticated file upload endpoint intended for portal document handling. The handler inspects the Content-Type value supplied by the HTTP client rather than deriving the MIME type server-side. It then writes the file to the WordPress uploads directory using the original filename and extension. This combination defeats WordPress's built-in extension filtering, because the plugin bypasses wp_check_filetype_and_ext() sanity checks that would normally reject executable file types.

Exploitation requires only Subscriber-level authentication, the lowest privileged role on most WordPress installations. Sites that allow open user registration are directly exposed to unauthenticated attackers who self-register before uploading.

Root Cause

The root cause is improper input validation of uploaded file metadata. The plugin uses attacker-controlled Content-Type and filename fields as trust anchors instead of validating the file's actual contents and enforcing an extension allowlist. No secondary check strips or rewrites the .php extension before writing to disk.

Attack Vector

An attacker with a Subscriber account crafts a multipart form upload targeting the plugin endpoint. The payload contains a PHP web shell but declares Content-Type: image/jpeg in the multipart headers. The plugin accepts the file, preserves the .php extension, and stores it under /wp-content/uploads/. The attacker then requests the uploaded PHP file directly, causing the web server to execute the shell in the context of the WordPress process user. See the WPScan Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2026-14553

Indicators of Compromise

New .php, .phtml, or .phar files present under wp-content/uploads/ or plugin-specific upload directories
Web server access logs showing POST requests to zportals upload endpoints followed by direct GET requests to newly created PHP files
Unexpected outbound connections from the PHP-FPM or web server process to attacker infrastructure
WordPress user accounts created shortly before suspicious upload activity

Detection Strategies

File integrity monitoring on wp-content/uploads/ to alert on any executable script file creation
Web application firewall rules that block multipart uploads containing PHP tags (<?php, <?=) regardless of declared MIME type
Static scanning of the uploads directory for PHP files using tools such as grep -R "<?php" wp-content/uploads/

Monitoring Recommendations

Alert on process execution chains where the web server user spawns sh, bash, python, or curl
Correlate WordPress Subscriber registrations with subsequent upload endpoint activity within short time windows
Monitor for HTTP responses returning PHP execution output from paths under /wp-content/uploads/

How to Mitigate CVE-2026-14553

Immediate Actions Required

Update the zportals plugin to version 6.3.4 or later on all WordPress installations
Audit wp-content/uploads/ for unexpected PHP files and remove any that are not part of a legitimate deployment
Review WordPress user accounts and revoke suspicious Subscriber registrations created before patching
Rotate WordPress secret keys, database credentials, and administrator passwords if compromise is suspected

Patch Information

Upgrade to zportals version 6.3.4, which introduces server-side validation of file contents and rejects executable extensions. Refer to the WPScan Vulnerability Advisory for confirmation of the fixed version.

Workarounds

Disable the zportals plugin until the patched version can be deployed
Disable open user registration by unchecking Anyone can register under WordPress general settings
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Deploy a WAF rule blocking uploads whose body contains PHP opening tags

bash

# Apache: block PHP execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}