Newspapers X CVE-2026-81779

Exploitation requires that the site run the specific compromised Silk Themes 'Newspapers X' theme at version 1.0.46, 1.0.47, or 1.0.48 - the malicious code is present only in those releases, which is the concrete precondition. Given CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or non-default configuration is needed beyond having the affected theme installed and the site network-reachable; the theme must be active/loaded for its PHP to execute. The limiting factor is therefore theme presence and version: sites on earlier versions or other themes are not exposed, which narrows the population despite the maximal CVSS.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximal 10.0, consistent with a network-reachable, low-complexity, unauthenticated backdoor that changes scope to affect the underlying host. Because the malicious code is shipped inside the product rather than requiring a crafted exploit, an attacker who knows the backdoor trigger faces essentially no barriers. However, key prioritization signals are missing: no EPSS score, no CISA KEV entry, and no confirmed public POC were provided, so widespread automated exploitation cannot be asserted. The single-source (Patchstack) provenance and the mismatch between the CWE-1284 classification and the 'backdoor' framing warrant verification, but the combination of full CIA impact, no authentication, and a pre-implanted backdoor makes this a genuine high-priority issue for any site running the named versions.

An attacker who knows the implanted backdoor's trigger sends a crafted HTTP request to any site running Newspapers X 1.0.46-1.0.48, invoking the hidden code path with no login required. The backdoor executes attacker-supplied commands as the web server user, letting the attacker exfiltrate data, deface or inject content, and establish persistent access. No public POC is confirmed in the available data, but the backdoor being pre-shipped removes most technical barriers.