CVE-2026-14553 is a vulnerability in the zportals WordPress plugin prior to version 6.3.4. The plugin fails to properly validate uploaded files by trusting the client-supplied content type and preserving the original file extension. This flaw allows any authenticated user with at least Subscriber privileges to upload arbitrary PHP files, which can be executed remotely, resulting in remote code execution.

An attacker with authenticated access (Subscriber or higher) can upload malicious PHP files, leading to remote code execution. This compromises the confidentiality and integrity of the affected system, allowing the attacker to execute arbitrary code with the privileges of the web server user. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions to prevent untrusted users from uploading files or disable the vulnerable plugin. Monitor vendor channels for updates and apply patches promptly once available.