Executive brief
The EscortWP theme for WordPress contains a vendor-authored backdoor that allows an attacker to permanently delete all website content. Additionally, the theme secretly transmits sensitive information, including the administrator's email address and license keys, to a third-party server. This malicious code was intentionally included by the developer and poses a severe risk to site availability and data privacy.
Technical details
The EscortWP theme (up to version 3.6.2) includes a vendor-authored backdoor hidden within 'functions-mobile-detect.php' using multiple layers of obfuscation (base64, gzuncompress, and eval). An unauthenticated attacker can trigger a permanent, forced deletion of all posts and site content by sending a hard-coded, per-build key to the 'ajax_check_mobile_detect_legacy' AJAX action. Furthermore, the theme functions as spyware by beaconing the site URL, admin email, and license key to a remote server (escortwp.com). Because the unique per-build key is exfiltrated to the vendor, the theme author effectively possesses a remote 'kill switch' for every installation. No official fix is currently available; users are advised to migrate to a different theme.
Affected products
- EscortWP EscortWP theme <= 3.6.2
Timeline
- 2026-04-17: other: Initial discovery or related activity
- 2026-06-19: disclosed: Publicly published by WPScan
- 2026-07-10: advisory: CVE published to NVD