PX-lab Zombify WordPress plugin: Unrestricted file upload leading to web shell upload

Summary

The Zombify WordPress plugin up to and including version 1.7.7 allows unauthenticated attackers to upload files of dangerous types, such as PHP web shells, to the web server. CVSS 10.0 (critical) is assigned by the CNA Patchstack. A public proof-of-concept exploit exists, and the vendor has not confirmed a fixed version, so an attacker can likely take over affected websites without login.

Affected

• Zombify WordPress plugin, all versions up to and including 1.7.7
• Plugin may be bundled with themes, for example BoomBox (check theme packages too)

Fixed in

Unknown. No fixed version has been confirmed. Do not assume that 1.7.6 or a later release is safe; verify with PX-lab or WordPress.org.

Workaround

• Deactivate and remove the Zombify plugin if it is not required
• Block PHP execution in upload directories
• Scan upload and plugin folders for unexpected PHP files
• Restrict new user registration until the issue is resolved
• Check whether a WAF or virtual-patching rule is available for this CVE (unknown)

Exploitation

• Public proof-of-concept exploit: yes (GitHub, published around 10 October 2026)
• Exploited in the wild: not confirmed
• CISA KEV status: unconfirmed; verify in the CISA KEV catalogue and VulnCheck
• EPSS 0.00282 (low, automatically generated)

Our recommendation

• Check all WordPress sites for Zombify, including those inside theme bundles
• Remove or deactivate Zombify where it is not needed
• If it is needed, apply protective measures and monitor for changes until an official fix is confirmed
• Scan websites for web shells and unexpected PHP files; if found, treat the site as compromised
• Prioritise an inventory check if you manage several client sites

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Wayang1337/CVE-2026-94503

Research sources

• Patchstack advisory for CVE-2026-94503 patchstack.com
• Public proof-of-concept repository github.com
• VulDB entry 415797 vuldb.com
• Patchstack Zombify vulnerability list patchstack.com
• PX-lab BoomBox changelog documentation.px-lab.com
• Strix CVE details www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:31.