CVE-2025-6990 — Vulnerability intelligence
hogash — KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
Published:
- CVSS
- 8.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget. This is due to the theme not restricting access to the code editor widget for non-administrators. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.