Devkit Pro
Monthly
Remote code execution is possible in the DevKit Pro WordPress plugin (versions ≤ 2.3.0) by any authenticated user holding Subscriber-level access or higher. The DPDEV_install_themes_func() function, registered on the wp_ajax_DPDEV_install_themes AJAX action, lacks both a WordPress capability check and nonce validation, allowing low-privileged users to upload and extract arbitrary theme ZIP packages - including PHP webshells - into the web-accessible wp-content/themes/ directory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege requirement (Subscriber) makes this a realistic risk on any WordPress site with open user registration.
Remote code execution is possible in the DevKit Pro WordPress plugin (versions ≤ 2.3.0) by any authenticated user holding Subscriber-level access or higher. The DPDEV_install_themes_func() function, registered on the wp_ajax_DPDEV_install_themes AJAX action, lacks both a WordPress capability check and nonce validation, allowing low-privileged users to upload and extract arbitrary theme ZIP packages - including PHP webshells - into the web-accessible wp-content/themes/ directory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege requirement (Subscriber) makes this a realistic risk on any WordPress site with open user registration.