What is the CVSS score of CVE-2026-12685?

CVE-2026-12685 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of EscortWP theme are affected by CVE-2026-12685?

EscortWP WordPress theme (versions through 3.6.2) contains a deliberately engineered backdoor allowing unauthenticated attackers to permanently destroy site content and exfiltrate sensitive data…

Is there a public PoC exploit available for CVE-2026-12685?

Yes, a public proof-of-concept exploit is available for CVE-2026-12685. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12685?

Within 24 hours: Audit all WordPress installations for EscortWP theme presence and immediately disable or remove the affected theme; if systems have been operational, take offline backups for forensic analysis. Within 7 days: Conduct forensic review of access logs, database deletion events, and outbound network traffic for exploitation indicators; restore all content from verified clean backups predating theme installation or rebuild from version control; deploy file integrity monitoring on WordPress core and theme directories. Within 30 days: Migrate all affected sites to an alternative, actively maintained WordPress theme; implement Web Application Firewall rules to block exploitation attempts and establish continuous monitoring for data exfiltration; conduct vendor risk assessment and remove any other Escortwp-related plugins or dependencies.

EscortWP theme CVE-2026-12685

EUVD-2026-42830 HIGH

2026-07-10 WPScan

GHSA-vvr8-3962-w5v6

WordPress Information Disclosure Escortwp Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

9.4 CRITICAL

Unauthenticated remote trigger via static key (AV:N/AC:L/PR:N/UI:N); permanent deletion of all content is high integrity and high availability, and covert exfil of URL/admin email/license is limited confidentiality (C:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:08 vuln.today

CVE Published

Jul 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator email address, and license key to a third-party server.

AnalysisAI

Content destruction and covert data exfiltration in the EscortWP WordPress theme (all builds through 3.6.2) stem from a deliberately obfuscated, vendor-authored backdoor rather than an accidental coding flaw. Any unauthenticated remote attacker who knows the hard-coded per-build key can permanently delete every piece of the site's content, while the theme silently beacons the site URL, administrator email, and license key to a third-party server. Publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.14%, 4th percentile) and it is not on CISA KEV.

Technical ContextAI

EscortWP is a commercial WordPress theme (an installable presentation/functionality layer that runs with full PHP execution rights inside the WordPress instance). The issue is not a memory-safety or injection bug but a planted backdoor: obfuscated PHP shipped in the theme package exposes an unauthenticated destructive endpoint gated only by a static, build-specific key, plus a phone-home routine transmitting identity and licensing data. The NVD entry lists CWE as N/A, but the behavior maps to hidden functionality / embedded malicious code (CWE-506 backdoor) combined with insider-planted unauthorized data transmission (CWE-359/CWE-912 class). The CPE 'cpe:2.3:a:unknown:escortwp:*' reflects that the vendor identity is not cleanly attributed in the CPE dictionary, consistent with a theme sold under license keys rather than a well-known open-source project.

RemediationAI

No vendor-released patch identified at time of analysis, and because the malicious code was vendor-authored, a vendor 'update' cannot be trusted to remove the backdoor - the primary remediation is to completely remove the EscortWP theme (deactivate and delete all theme files, not merely switch the active theme) and migrate to a trusted theme. Before removal, rotate any credentials and the license key that may have been exfiltrated, and rotate the administrator email/password since site URL, admin email, and license key were transmitted to a third party. As compensating controls until removal is complete: block outbound connections from the web host to the theme's phone-home destination (identify it via the WPScan advisory or egress logs) to stop data leakage - trade-off is it does not stop the destructive endpoint; and put the site behind a WAF or restrict access to the unauthenticated backdoor endpoint if its path is identified in the WPScan report - trade-off is the static key path may vary per build, so egress blocking plus full theme removal is the only reliable fix. Consult https://wpscan.com/vulnerability/0e5f5730-167d-4853-a764-bb9e3d62fdc4/ for endpoint and indicator details.