Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-94503 (CVSS: 10) PX-lab CVE-2026-108263 (CVSS: 9.9) iflytek CVE-2026-100730 (CVSS: 9.8) Grid Protect... CVE-2026-105278 (CVSS: 9.8) Grid Protect... CVE-2026-108474 (CVSS: 9.8) JetBrains ..🧵👇
Here’s what hit the feed 👇 🟠 HIGH PRIORITY (CVSS 9.8-10) ├ CVE-2026-94503 · WP Zombify ≤1.7.7 · Arbitrary file upload (10) ├ CVE-2026-108263 · iFlytek Astron Agent · Unsandboxed code node → cross-tenant RCE (9.9)
[CVE] CVE-2026-94503 [HIGH PRIORITY] CVSS: 10 | Vendor: #PXlab #WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability 🔗 https://exploitgrid.net/cve/CVE-2026-94503
#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL UNPATCHED WORDPRESS ZOMBIFY FLAW ALLOWS UNAUTHENTICATED WEB-SHELL UPLOAD October 4, 2026 DISCLOSED BY: Patchstack PRODUCT: Zombify — WordPress Plugin CVE: CVE-2026-94503 SEVERITY: Critical — CVSS 10.0 AFFECTED VERSIONS: Zombify 1.7.7 and earlier. PATCH STATUS: No official patch available as of October 11. IMPACT: Unauthenticated attackers can upload malicious files, including web shells, to vulnerable WordPress servers. If an uploaded script is executable by the web server, attackers may gain remote command execution and compromise the hosting environment. EXPLOITATION STATUS: CONFIRMED VULNERABILITY. Publicly disclosed October 4; CVE published October 9. Active malicious exploitation remains unverified. Forensic triage: Inspect suspicious file-upload requests and unexpected executable files in WordPress upload directories. Review recent PHP file creation, suspicious server processes, and unauthorized administrator activity. No vulnerability-specific malicious IOCs have been confirmed. URGENT ACTION: Disable or remove affected Zombify installations until a verified fix becomes available. Block script execution in upload directories. Patchstack has released a mitigation rule for affected installations. SOURCE: https://patchstack.com/database/wordpress/plugin/zombify/vulnerability/wordpress-zombify-plugin-1-7-7-arbitrary-file-upload-vulnerability?_s_id=cve CONFIDENCE: HIGH — Patchstack vulnerability disclosure and CNA-assigned CVE. Real-world exploitation remains unverified. #CyberSecurity #ThreatIntel #WordPress #RCE #FileUpload #WebSecurity #NØØT