CVE-2026-27419

The Zegen plugin in versions 1.1.9 and earlier allows a subscriber to upload arbitrary files to the server. This vulnerability can be exploited to upload malicious software without proper authorization.

An attacker with a subscriber role can upload an executable file, leading to server compromise, data theft, or further propagation of the attack within the organization's network.

Immediately update the Zegen plugin to the latest available version that fixes this vulnerability. Additionally, restrict subscriber file upload permissions to only allowed file types.