Genemy WordPress Theme EUVD-2025-210230

Exploitation requires the target WordPress site to have the Genemy theme version 1.6.6 or earlier active, and the attacker must possess a valid subscriber-level (or higher) account on the target site - typically obtained via self-registration if enabled, or through compromise of an existing low-privileged account. The attack is network-reachable with no user interaction required (per CVSS AV:N/UI:N), but the practical limiting factor is whether the target site permits new user registration; sites with registration disabled and tightly controlled account provisioning materially constrain the attack surface. The specific WordPress endpoint, parameter, or theme feature that performs the incorrect privilege assignment is not disclosed in the available description, so the exact request shape required for exploitation cannot be determined from this data alone.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable exploitation requiring only a low-privileged (subscriber) account, with high impact across confidentiality, integrity, and availability - consistent with full administrative takeover of a WordPress site. No EPSS score, KEV listing, or public POC is referenced in the input, so real-world exploitation pressure cannot be quantified from the provided data; however, Patchstack-reported WordPress theme privilege escalations historically attract automated exploitation once details circulate, particularly on sites where open registration is enabled. The risk concentrates on WordPress sites running Genemy that permit self-registration or have multi-author setups; sites with registration disabled face materially lower exposure since obtaining a subscriber account becomes a prerequisite hurdle.

An attacker registers a free subscriber account on a Genemy-powered WordPress site that allows open registration, then sends a crafted request to a vulnerable theme endpoint that improperly assigns or accepts an elevated role parameter, promoting their account to administrator. With administrator access, the attacker installs a malicious plugin or modifies theme files to achieve persistent remote code execution on the underlying web server.