CVE-2026-94503

CRITICAL POC TTE Zero-Day Pub 09/10 Upd 12/10

Overview

The vulnerability is an unrestricted file upload flaw classified under CWE-434, occurring in the file upload handling component of PX-lab Zombify. The root cause is a lack of proper validation or restriction on uploaded file types, allowing dangerous file formats to be accepted and stored on the server. This issue affects versions up to and including 1.7.7, specifically in the upload functionality that processes user-submitted files without adequate sanitization or filtering.

Vulnerability Description

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

Impact

An attacker can upload and execute arbitrary web shells on the affected server without any authentication, gaining full control over the web server environment. This enables remote code execution, data theft, server manipulation, and lateral movement within the network. The vulnerability allows complete system compromise, potentially leading to data breaches, service disruption, and unauthorized access to sensitive information. No user interaction or credentials are required to exploit this vulnerability, increasing its severity and ease of exploitation.

Solution

To remediate this vulnerability, upgrade PX-lab Zombify to a version later than 1.7.7 where the file upload validation flaw is fixed, as documented in the advisory at https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve. Implement strict server-side validation of file types and restrict uploads to safe extensions only. Refer to the vendor's patch instructions on Patchstack for detailed guidance on applying the security update and mitigating this issue.

EPSS vs KEV Prediction — Evolution (30 days)

Affected Products

No CPE information available.

Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk. Learn more

GitHub PoCs (1)

Repository Author Stars Forks Date Link
Wayang1337/CVE-2026-94503
Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload
 Wayang1337 0 0 2026-10-10 View
Exploited in Wild CONFIRMED
Ransomware NOT ASSOCIATED
Attacker Interest HIGH
Sightings Some sightings

Threat Feed

5 events
2026-10-13
Threat Sensor Sighting — Some sightings

Sighting activity recorded

2026-10-10
PoC Published (1 GitHub repositories)

Proof-of-concept code is publicly available for this vulnerability

2026-10-09
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-10-04
Detected as Exploited in the Wild

Active exploitation confirmed — vendor: , product:

Detected as Exploited in the Wild (16 sightings)

Active exploitation confirmed with 16 sighting(s)

Likely Kill Chain

Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.

Applicable Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040

Highlighted stages are those attackers typically reach when exploiting this CVE. Heuristic based on CWE families — refined by ML classifier when available.

Attack Vectors ML

File Upload Vulnerabilities
100% file_upload
Remote Code Execution
29% rce

MITRE ATT&CK Techniques (0)

ATT&CK techniques pending

Techniques are derived from this CVE's kill chains once ML classification completes.

CAPEC Attack Patterns ML

ID Name ML Conf. Likelihood Severity Link
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
30%
High High

Red Team Playbook

AtomicRedTeam integration in progress

Executable commands will be auto-mapped to each ATT&CK technique of this CVE.

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles found for this CVE.

References (2)

Title Tags URL
nvd.nist.gov
NVD reference
https://nvd.nist.gov/vuln/detail/CVE-2026-94503
patchstack.com
GitHub CVE vdb-entry
https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve