PT-2026-54977 · Zozothemes+1 · Zegen

Tran Nguyen Bao Khanh · CVE-2026-27419 · Published 2026-06-29 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zegen versions prior to 1.2.0

Description Zegen - Church WordPress Theme allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server. This issue occurs due to missing file type validation, which could potentially lead to remote code execution.

Recommendations Update Zegen to version 1.2.0 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-27419

Affected Products

Zegen

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-27419 · Security Note
• https://reddit.com/r/StopBadBots/comments/1us1z36/wordpress_cyber_apocalypse_88_unpatched_flaws · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/609e1177-15aa-476b-b56b-299495055850?source=api-prod · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27419 · Note
• https://patchstack.com/database/wordpress/theme/zegen/vulnerability/wordpress-zegen-theme-1-1-9-arbitrary-file-upload-vulnerability?_s_id=cve · Note