Unauthenticated Arbitrary File Upload in WordPress Plugin

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The zportals WordPress plugin before version 6.3.4 contains a critical file upload vulnerability that trusts client-supplied content types and preserves original file extensions without proper validation. This allows any authenticated user with Subscriber privileges or higher to upload malicious PHP files to the server, leading to remote code execution (RCE). With a CVSS score of 8.1, this vulnerability poses a significant risk to WordPress installations using this plugin, as attackers can gain complete control over affected websites. The threat is amplified by the low barrier to exploitation—attackers need only basic authentication access, which could be obtained through credential compromise or social engineering.

Casky's security skills framework, leveraging Claude AI with extended reasoning across 754 MITRE ATT&CK-mapped techniques, would detect the attack patterns associated with this vulnerability through three critical technique mappings: TA0001 (Initial Access), TA0043 (Reconnaissance), and TA0002 (Execution). Practitioners using Casky would see detection findings correlating suspicious file upload activity with PHP file creation in web-accessible directories, MITRE technique TA0002 execution patterns showing PHP interpreter invocation, and behavioral indicators of post-exploitation activity. The platform would surface specific indicators such as unexpected .php files in upload directories, HTTP POST requests with mismatched MIME types and file extensions, and subsequent web shell activity—enabling security teams to identify compromise attempts before attackers achieve code execution and persistence on the server.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14553.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-14553

Casky has 446 skills that investigate the attack patterns behind CVE-2026-14553. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn