The Zegen theme up to version 1.1.9 contains an input‑validation flaw allowing WordPress subscribers to upload files through the theme’s interface without MIME type or extension checks. This weakness, classified as CWE‑434, can result in the execution of arbitrary code if the file is later served by the server. Based on the description, it is inferred that a malicious file such as a PHP backdoor could be executed when requested, enabling full control over the site’s server. The vulnerability carries a CVSS score of 9.9, underscoring its severe risk level.

WordPress sites that have the Zegen theme installed at version 1.1.9 or earlier are affected. The issue does not impact core WordPress or other plugins. Site owners should verify the theme version and ensure it is not obsolete.

An attacker only needs subscriber‑level access to reach the upload endpoint, making the attack vector likely through the web interface. Once a payload is uploaded, execution is possible if the server serves the file without blocking executable content—this is inferred from the nature of the flaw. The EPSS score of less than 1 % indicates a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the potential for full remote code execution combined with a high CVSS score makes the risk significant for confidentiality, integrity, and availability.