Critical Web Shell Upload Vulnerability Found in PX-lab Zombify Plugin

A critical security vulnerability has been identified in the PX-lab Zombify plugin, allowing attackers to upload malicious web shells to web servers. The flaw, tracked as CVE-2026-94503, carries a maximum CVSS score of 10, indicating a severe risk to affected systems.

The vulnerability stems from an unrestricted upload of files with dangerous extensions. According to the National Vulnerability Database (NVD) record, this weakness is classified under CWE-434. Attackers can exploit this issue to gain unauthorized access to the server hosting the Zombify plugin. The NVD description explicitly states that the issue allows the upload of a web shell, which provides remote command execution capabilities to the attacker.

Context and Background

The severity of this vulnerability is underscored by its perfect CVSS score. A score of 10 indicates that the flaw can be exploited remotely without authentication and results in a total loss of confidentiality, integrity, and availability. The underlying weakness, CWE-434, refers to the failure to properly validate the type of file being uploaded. This allows an attacker to bypass standard file type restrictions and upload executable scripts or other malicious code.

PX-lab Zombify is a plugin that appears to be widely used, given the specific versioning tracked in the advisory. The lack of proper input validation on the upload function creates a direct path for compromise. Once a web shell is uploaded, an attacker can execute arbitrary commands on the server, potentially leading to data theft, defacement, or further lateral movement within the network.

Who Is Affected

The vulnerability affects all versions of PX-lab Zombify from its initial release through version 1.7.7. The NVD record specifies that the issue affects Zombify "from n/a through 1.7.7," indicating that no version prior to or including 1.7.7 is safe from this exploit. Organizations and individuals using any of these versions are at immediate risk.

There is no mention of a patched version or a fix in the current source material. Users running version 1.7.7 or earlier should assume their systems are vulnerable until a confirmed update is released by the vendor. The widespread nature of web shell attacks means that automated scanning tools may already be targeting sites running this plugin.

What should you do?

Administrators should immediately audit their systems to determine if PX-lab Zombify is installed. If present, check the version number against the affected range. Monitor server logs for unusual upload activity or requests for known web shell filenames. Restrict file upload permissions where possible and ensure that only necessary file types are allowed. Await an official update from PX-lab that addresses CVE-2026-94503.