Description

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T06:17:16.110Z",
  "pubdate": "2026-09-02T06:17:16.110Z",
  "executiveSummary": "The DevKit Pro plugin for WordPress is susceptible to an arbitrary file upload and remote code execution vulnerability due to insufficient authorization controls. Specifically, the wp_ajax_DPDEV_install_themes action lacks requisite capability checks and nonce validation, allowing authenticated users with minimal privileges—such as Subscribers—to execute theme installation procedures.\nThe vulnerability originates from the failure to verify if the requesting user possesses administrative privileges before invoking the DPDEV_install_themes_func() function. By bypassing security checks, an attacker can upload and extract malicious ZIP archives directly into the wp-content/themes/ directory. This provides a clear path for remote code execution (RCE) by deploying web shells or backdoored themes.\nGiven that WordPress theme directories are web-accessible, the successful exploitation of this flaw leads to full site compromise, potential server-side takeover, and persistent backdoor installation. The risk is critical, as it bridges the gap between low-privileged account access and complete system control.",
  "technicalDetails": "The vulnerability is localized within the DPDEV_install_themes_func() function, which serves as the handler for the wp_ajax_DPDEV_install_themes AJAX action. The root cause of the vulnerability is twofold: the absence of a proper capability check (such as current_user_can('manage_options')) and the failure to implement CSRF protection via nonces. In the WordPress security architecture, AJAX actions intended for administrative tasks must validate the request context to ensure the caller is authorized to perform sensitive operations.\nThe exploitation flow begins when an attacker, authenticated as a Subscriber or any higher-privileged user, transmits a crafted POST request to the WordPress admin-ajax.php endpoint. The payload includes the action parameter set to DPDEV_install_themes along with an arbitrary theme ZIP file package. Because the handler performs no authorization verification, the plugin processes the request as if it were a legitimate administrative installation task.\nUpon receiving the request, the DPDEV_install_themes_func() function invokes standard theme installation routines. This mechanism extracts the contents of the provided ZIP file into the /wp-content/themes/ directory. An attacker can craft a ZIP file containing a malicious PHP script disguised as a theme template. Since the web server environment is configured to parse PHP files within the themes directory, the uploaded file becomes immediately accessible via a direct HTTP request. Once the attacker navigates to the location of the uploaded script, the embedded PHP code executes under the context of the web server process.\nThe scope of impact includes remote code execution, which facilitates unauthorized access to the underlying server environment, sensitive data exfiltration, and potential lateral movement within the hosting infrastructure. The vulnerability affects all versions of the DevKit Pro plugin up to and including 2.3.0. Because the attack vector utilizes standard WordPress AJAX endpoints, it is exposed to any user capable of logging into the site, significantly lowering the barrier for exploitation by malicious actors who have gained entry through phishing, credential stuffing, or secondary account compromise."
}