Smart Cleaning CVE-2026-74016

Exploitation requires a valid authenticated WordPress account at the low-privilege Subscriber level (CVSS PR:L) and that the site has the vulnerable Smart Cleaning theme <= 4.8.6 installed and active. The principal limiting factor is authentication: the attacker must first obtain a Subscriber account, so sites that disable open self-registration substantially raise the barrier, while sites with 'Anyone can register' enabled reduce it to near-trivial. No user interaction (UI:N) and no elevated privileges beyond Subscriber are needed, and the upload endpoint must be reachable over the network; successful code execution additionally assumes the server executes uploaded scripts (default on typical PHP/WordPress hosting).

The signals are largely consistent and point to a high-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H, score 9.9) indicates a network-reachable, low-complexity flaw needing only minimal privileges, with full confidentiality/integrity/availability impact and scope change consistent with server takeover. Countervailing factors are that exploitation is not unauthenticated - a Subscriber account is required - and there is no EPSS score, no SSVC decision data, and no KEV entry or public POC provided, so real-world exploitation is currently unproven and should be treated as latent rather than active. The practical risk hinges on site configuration: sites permitting open user registration effectively lower the bar to unauthenticated-equivalent, whereas sites with registration disabled meaningfully limit exposure. Given that WordPress webshell outcomes are well understood and easily automated once access exists, defenders running this theme should treat it as urgent even though widespread exploitation has not been demonstrated.

An attacker registers or obtains a Subscriber account on a WordPress site running Smart Cleaning <= 4.8.6, then submits a crafted request to the theme's file-upload feature to upload a PHP webshell instead of a permitted file type. Because the network vector is low-complexity with no user interaction required, the attacker then requests the uploaded file's URL to execute commands and take control of the server. No public exploit code is identified at time of analysis.