Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

CVE-2026-27419 describes an Arbitrary File Upload vulnerability affecting the Zegen WordPress theme in versions 1.1.9 and below. The flaw allows subscriber-level authenticated users to upload arbitrary files to the server, which can potentially lead to remote code execution. This type of vulnerability is particularly dangerous as it can enable attackers to plant malicious scripts or backdoors on the affected WordPress site. The vulnerability has been documented by both the NVD and Patchstack. A patch or updated version beyond 1.1.9 is expected to remediate the issue. WordPress theme vulnerabilities of this nature represent a significant risk to site owners who have not applied security updates.