CVE-2026-14357

Name of the Vulnerable Software and Affected Versions DevKit Pro plugin for WordPress versions prior to 2.3.1

Description An authorization flaw exists due to a missing capability check and missing nonce validation in the DPDEV install themes func() function registered on the wp ajax DPDEV install themes action. This allows authenticated attackers with Subscriber-level access or higher to install arbitrary theme ZIP packages containing PHP files. These files are extracted into the web-accessible wp-content/themes/ directory, which may enable remote code execution.

Recommendations Update the DevKit Pro plugin for WordPress to a version newer than 2.3.0. As a temporary mitigation, restrict access to the DPDEV install themes func() function.