Sonaar WordPress Theme EUVD-2025-210222

Attacker must have a valid authenticated Subscriber-level (or higher low-privilege) account on a WordPress site running the Sonaar theme at version 4.27.4 or earlier - practical only when open user registration is enabled, an attacker can otherwise obtain Subscriber credentials, or another bug grants Subscriber-level access. No user interaction by another user is required (UI:N), the vulnerability is reachable over the network via standard HTTP(S) to wp-admin/admin-ajax.php or theme endpoints (AV:N/AC:L), and exploitation is limited to sites where the Sonaar theme is the active or loaded theme exposing the affected handler.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8 (High) and reflects a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality/integrity/availability impact - consistent with a Subscriber-to-Admin takeover on WordPress. The vulnerability is not listed in CISA KEV and no EPSS score was supplied, and no public exploit is identified at time of analysis, so it is not currently a confirmed mass-exploitation target. However, many WordPress sites allow open Subscriber registration by default, and Patchstack-disclosed WordPress privilege escalations historically attract automated exploitation soon after public disclosure, so the real-world risk for any site running Sonaar <= 4.27.4 with registration enabled should be treated as high. Key data gap: the exact vulnerable endpoint and a fixed version are not present in the provided intelligence, so defenders must consult the Patchstack advisory directly to confirm patched build.

An attacker registers a free Subscriber account on a public-facing WordPress site running the Sonaar theme (or uses any pre-existing low-privilege credential), then issues a crafted authenticated request to the vulnerable theme endpoint to assign themselves the administrator role. With admin access they install a malicious plugin or modify theme files to achieve full code execution on the host, exfiltrate the user database, and maintain persistence; no public exploit is identified at time of analysis but the pattern is well known on the WordPress ecosystem.