Zakra WordPress Theme CVE-2026-4804

Exploitation requires an authenticated account with at least Contributor-level access to the WordPress site. The Zakra theme must be the active theme (versions up to and including 4.2.0) - it need not be in any special configuration beyond activation. The REST API must be accessible (WordPress REST API is enabled by default and commonly exposed publicly). No additional plugins, non-default settings, or specific configurations are required beyond theme activation and a valid low-privilege account. Exploitation is limited by the need for at minimum a Contributor credential - sites that disable open registration or restrict the Contributor role have meaningfully reduced exposure. The stored payload only executes when a victim user subsequently browses to a page containing the affected menu items, meaning impact depends on traffic and the value of targeted victim sessions (e.g., administrator accounts).

The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) appropriately reflects the real-world risk profile. Network attack vector and low complexity are accurate: exploitation requires only a standard authenticated REST API POST request. PR:L is correct since Contributors (the lowest posting role in WordPress by default) can write these meta fields. The Scope:Changed metric is justified because the XSS payload executes in victim browsers outside the contributor's own privilege boundary. UI:N is consistent with stored XSS convention where the attacker does not need to deliver a link - the payload fires automatically for any visitor. No EPSS score was provided in the input data, and there is no CISA KEV listing, meaning widespread active exploitation is not confirmed. No public POC exploit code is identified at time of analysis. The primary real-world risk is privilege escalation: a Contributor could inject JavaScript to steal admin session cookies or redirect administrators to attacker-controlled pages, potentially achieving full site takeover. The sanitization bypass via the REST API is a non-obvious but reliably exploitable path, making this a genuine priority for WordPress sites allowing Contributor registrations or untrusted contributors.

An attacker registers or obtains a Contributor-level account on the target WordPress site. They issue a REST API POST request to update the zakra_menu_item_color post meta field with a value containing a malicious JavaScript payload (e.g., a CSS string break followed by a script tag or expression). Because the REST API path applies no sanitize_callback, the raw payload is stored. When any administrator or visitor subsequently loads any page rendering that menu item, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or unauthorized administrative actions. No public POC has been identified, but the exploitation path is straightforward for any attacker familiar with WordPress REST API meta registration mechanics.