CVE-2025-6389

CVE-2025-6389 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the Sneeit Framework plugin for WordPress, affecting every version up to and including 8.3. The sneeit_articles_pagination_callback() function takes input supplied by the request and passes it directly to PHP's call_user_func(), so an unauthenticated attacker can send crafted input that causes the server to invoke attacker-chosen PHP functions. Successful exploitation yields arbitrary code execution on the server, which attackers can use to inject backdoors, create new administrative WordPress accounts, or take full control of the site and potentially the underlying host. Any WordPress site running the Sneeit Framework plugin at version 8.3 or earlier is affected. The flaw is not in CISA's KEV and no public proof-of-concept is known, but EPSS puts its exploitation probability in the next 30 days at 76.1% (100th percentile), and security reporting indicates it is already being exploited in the wild.

What to do: Update Sneeit Framework to the latest patched release (any version newer than 8.3); if updating is not immediately possible, deactivate or remove the plugin, or apply a WAF/virtual-patching rule that blocks the vulnerable pagination callback endpoint. Because the flaw is already exploited in the wild, sites that ran version 8.3 or earlier should audit wp_users for rogue administrator accounts, look for injected backdoors (unexpected PHP files, modified core/theme files, suspicious scheduled tasks), and review web access logs for exploitation attempts. Monitor the vendor and Wordfence advisories for the fixed version number and any indicators of compromise.