External risk intelligence

PX-lab Zombify Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-94503

The vulnerability affects a WordPress plugin, which is typically deployed as a component of an internet-facing web application. Since web plugins are designed to extend the functionality of public-facing sites, the exposed surface is commonly reachable from the internet.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Zombify plugin for PX-lab, allowing an attacker to upload a web shell to a web server. This could potentially lead to unauthorized control or access to the server, impacting the integrity and availability of services hosted on it. The primary concern is to confirm if this specific plugin and version are in use within our environment.

Attackers can upload harmful files.
It impacts public-facing web applications.
Confirm if Zombify is deployed and in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a malicious file to the web server. This is possible because the Zombify plugin does not properly restrict the types of files that can be uploaded. Once a malicious file, such as a web shell, is uploaded, the attacker can then execute commands on the server.

No authentication needed to access.
Uploading a dangerous file type.
Web server compromise, leading to data loss.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload a web shell to a web server. When supported by the advisory, this could lead to the compromise of the web server, impacting its availability and integrity.

Web server file system at risk.
Unrestricted file upload could occur.
Server compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Zombify plugin likely requires coordinated action. Application owners responsible for web content management systems should initiate the first step by identifying all instances of the Zombify plugin. Confirming its reachability from the internet and its criticality to business operations will guide subsequent prioritization and remediation planning, which may involve coordination with security teams and potentially the vendor.

Application owners should own the issue.
Verify plugin reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PX-lab Zombify plugin?

Zombify is a WordPress plugin used to add specific content or functional features to websites built on the WordPress platform. Plugins like this act as modular extensions that run within the web server environment to handle user-submitted content or media, which is how this component integrates into a site's infrastructure.

What does CWE-434 mean for CVE-2026-94503?

CWE-434, or Unrestricted Upload of File with Dangerous Type, means the plugin fails to verify the contents or extension of files being uploaded. In CVE-2026-94503, this flaw allows an attacker to bypass intended restrictions and upload a web shell, which is a malicious script designed to execute commands on the server.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the web server that includes a harmful file. This does not require any prior user authentication. Importantly, simply having the plugin installed does not trigger the bug; the vulnerability is only activated when an attacker successfully interacts with the file upload functionality provided by the plugin.

Why is this CVE considered an external risk?

Halo Surface Signal classifies this as external because the plugin is designed to extend public-facing WordPress sites. Since the component handles web requests, it is commonly accessible over the internet. This means anyone with network access to the web server can potentially attempt to exploit the file upload process without needing to be inside the internal network.

How should I respond to this threat?

The first step is to perform an inventory of your WordPress environments to identify if the Zombify plugin is installed and active. You should verify which versions are running—specifically checking for anything through version 1.7.7. Once located, evaluate whether the plugin is essential for business operations while security teams coordinate a path toward updating or removing the component to neutralize the risk.

References

patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordp…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.