Zegen Core for WordPress is vulnerable to a cross‑site request forgery (CWE‑352) that allows an unauthenticated attacker to upload arbitrary files via the /custom-font-code/custom-fonts-uploads.php endpoint. The flaw stems from missing nonce validation and a lack of file‑type checks, so a malicious request can be dispatched to the server and any file placed on the webroot. If the attacker manages to get a site administrator to follow a crafted link, the uploaded file could be executed, enabling remote code execution on the host.

The vulnerability affects the Zegen Core plugin from Zozothemes for WordPress versions up to and including 2.0.1. Any site running one of those versions is at risk.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is under 1% and the issue is not listed in the CISA KEV catalog, suggesting exploitation is not yet widespread. The attack vector is a web‑based CSRF: an attacker must induce an authenticated administrator to visit a crafted URL or submit a forged form to trigger a file upload. If successful, the attacker could upload a malicious payload that later executes with the privileges of the web server. Given the systemic nature of the impact, the risk remains significant despite the low exploitation probability.