The vulnerability in the Zella Theme WordPress theme allows an unauthenticated user to upload arbitrary files through a font upload endpoint that lacks capability or nonce validation. The uploader accepts any payload, including PHP scripts, which are then executed on the server, giving the attacker full control of the compromised site. This flaw stems from an insufficient access‑control check, enabling traditional arbitrary file‑upload injection attacks that can be leveraged for remote code execution.

Any WordPress installation using the Zella Theme before version 2.6.3 is affected. The vendor is unknown, but the defect exists within the theme plugin files that handle font uploads. All installations running a pre‑2.6.3 build of the theme are vulnerable, regardless of other security configurations.

The flaw permits remote code execution without authentication, a severity reflected in a CVSS score of 9.8. The absence of a capability or nonce check means that any Internet‑exposed WordPress site using the vulnerable theme can be compromised. The exploit is trivial: simply craft a HTTP request to the upload endpoint with a malicious PHP file. The EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the risk from an unauthenticated RCE remains significant.