This vulnerability in Z-BlogPHP 1.7.5 arises from improper handling in the App::UnPack function within the ZBA File Handler component, specifically in the /zb_users/plugin/AppCentre/app_upload.php file. It permits an attacker with high privileges to upload files without restriction, potentially leading to unauthorized file placement on the server. The attack vector is network-based and does not require user interaction. Although an exploit exists publicly, there is no indication of active exploitation in the wild. The vendor has not issued any patch or advisory as of the publication date.

Successful exploitation allows a high-privilege attacker to upload arbitrary files to the server, which could lead to further compromise depending on the uploaded content and server configuration. The vulnerability is remotely exploitable and does not require user interaction. However, the requirement for high privileges limits the attack surface. No evidence of active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider restricting access to the affected upload functionality and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.