Unauthorized Remote Code Execution in DevKit Pro Plugin for WordPress

The DevKit Pro plugin for WordPress is vulnerable to an authorization flaw identified as CVE-2026-14357. The vulnerability exists within the DPDEV_install_themes_func() function, which is registered to the wp_ajax_DPDEV_install_themes action. The function lacks proper capability checks and nonce validation, allowing any authenticated user - including those with low-privilege 'Subscriber' access - to trigger the theme installation process. By submitting a crafted request, an attacker can upload and extract an arbitrary ZIP package containing PHP files directly into the web-accessible 'wp-content/themes/' directory of the WordPress instance. Because these files are then accessible via the web server, this flaw directly facilitates remote code execution (RCE). This issue affects all versions of the DevKit Pro plugin up to and including 2.3.0.

Impact

Successful exploitation allows an unprivileged attacker to achieve remote code execution on the WordPress server. This could lead to full site compromise, data exfiltration, or lateral movement within the hosting environment. Organizations using affected versions of the DevKit Pro plugin are at high risk of unauthorized administrative control over their web infrastructure.

Recommendation

1. Immediately update the DevKit Pro plugin to the latest available version beyond 2.3.0 to patch CVE-2026-14357.
2. Implement a Web Application Firewall (WAF) rule to monitor or block POST requests to 'wp-admin/admin-ajax.php' containing the 'action=DPDEV_install_themes' parameter if the update cannot be applied immediately.
3. Audit the 'wp-content/themes/' directory for any unauthorized or suspicious subdirectories or PHP files added by low-privileged user accounts.