EUVD-2026-68805
GHSA-g37c-r8pg-6jqx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Pre-shipped backdoor is network-reachable, unauthenticated, low-complexity server-side code execution; scope changes to the host with full CIA loss, matching a 10.0.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
AnalysisAI
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the site run the specific compromised Silk Themes 'Newspapers X' theme at version 1.0.46, 1.0.47, or 1.0.48 - the malicious code is present only in those releases, which is the concrete precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximal 10.0, consistent with a network-reachable, low-complexity, unauthenticated backdoor that changes scope to affect the underlying host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data, so the safest action is to remove the affected theme entirely rather than rely on an in-place update: deactivate and delete Newspapers X versions 1.0.46 through 1.0.48 and switch to a trusted theme. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations running Silk Themes 'Newspapers X' versions 1.0.46 through 1.0.48, immediately deactivate and remove these versions, and deploy an alternative WordPress theme from a verified vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today