Executive brief
DevKit Pro is a WordPress plugin that helps developers manage sites without needing FTP or cPanel access. The plugin contains a flaw that allows any authenticated user, even those with the lowest-level Subscriber role, to upload and install arbitrary theme files. An attacker can use this to upload malicious PHP code that executes on the web server, potentially compromising the entire WordPress installation and any data it contains.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the DPDEV_install_themes_func() function, which handles AJAX theme installation requests via the wp_ajax_DPDEV_install_themes action. The function lacks both capability checks (to restrict access to administrators) and nonce validation (to prevent CSRF attacks), allowing any authenticated user to bypass access controls. An attacker with Subscriber-level access can send a crafted AJAX request to install arbitrary ZIP packages containing PHP files into the web-accessible wp-content/themes/ directory. The PHP code will be extracted with web-server permissions and can be executed through direct HTTP requests, achieving remote code execution. Versions up to and including 2.3.0 are affected; patched versions should implement proper role-based access checks and nonce validation.
Affected products
- DPlugins DevKit Pro up to and including 2.3.0
Timeline
- 2026-09-02: disclosed