CVE-2026-14357

DevKit Pro, a WordPress plugin, is vulnerable to missing authorization (CWE-862) in versions up to and including 2.3.0, because the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes AJAX action performs no capability check and no nonce validation. Any authenticated user with Subscriber-level access or higher — for example a self-registered account on sites with open registration — can invoke this AJAX action to install arbitrary theme ZIP packages, whose PHP files are extracted into the web-accessible wp-content/themes/ directory. Because the attacker controls PHP files placed in a web-accessible location, this can lead to remote code execution on the affected site. All WordPress sites running DevKit Pro 2.3.0 or earlier are affected, including sites whose only user accounts are low-privileged subscribers. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and EPSS assigns a 0.6% probability of exploitation within 30 days, indicating no confirmed exploitation at this time.

What to do: Sites running DevKit Pro 2.3.0 or earlier should update to the latest patched release (any version after 2.3.0) as soon as it is available; in the interim, deactivate the plugin or restrict/disable open user registration so untrusted users cannot obtain Subscriber-level accounts. Administrators should inspect wp-content/themes/ for unexpected or recently created theme directories containing PHP files and audit Subscriber-level accounts for signs of misuse.