Vayu X EUVD-2026-89614

Requires the Vayu X WordPress theme at a version before 1.0.6 to be active, and requires the attacker to hold any authenticated account no higher than Subscriber (so sites permitting open self-registration are directly exploitable; sites without registration require some existing low-privilege credential). The theme's AJAX action performs no capability check and leaks its guarding nonce to every logged-in user, so the normal nonce defense provides no protection. Exploitation is limited to installing/activating plugins present in the WordPress.org repository rather than uploading arbitrary code directly, so the maximum-impact path (RCE) depends on chaining to a vulnerable installed plugin; there is no unauthenticated exploitation and no user interaction from a victim is needed.

Signals are mostly consistent and point to a moderate, credential-gated authorization flaw rather than an urgent internet-wide threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) describes a low-privilege authenticated attacker over the network with no user interaction, and the high integrity impact reflects that a subscriber can install and activate arbitrary WordPress.org-hosted plugins - a strong site-integrity primitive. CISA SSVC reinforces the lower urgency: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is: no public exploit identified at time of analysis. The main risk amplifier is not raw severity but the pivot: arbitrary plugin installation lets an attacker deliberately install an older or known-vulnerable plugin and then exploit it for RCE, effectively turning a subscriber account into full site compromise. The gating factor is that PR:L requires an existing authenticated account (e.g. an open-registration subscriber), which is why this is a real but not top-tier priority.

On a site running Vayu X before 1.0.6 with open user registration, an attacker registers a subscriber account, harvests the AJAX nonce that the theme exposes to every logged-in user, and calls the unprotected AJAX action to install and activate an attacker-chosen WordPress.org plugin. They then either exploit a known vulnerability in that freshly installed plugin or use its functionality to escalate toward code execution and full site takeover. No public exploit code was identified at time of analysis, and no active exploitation is reported.