DevKit Pro permits Subscriber-level arbitrary theme installation
DevKit Pro through 2.3.0 registers DPDEV_install_themes_func() on wp_ajax_DPDEV_install_themes without a capability check or nonce validation. A Subscriber or higher can install an arbitrary theme ZIP containing PHP into the web-accessible wp-content/themes directory, potentially leading to remote code execution.
- Component
- DevKit Pro
- Plugin slug
devkit-pro- Affected
- <= 2.3.0
- Safe version
- See mitigation notes
- Published
- Sep 02, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 02, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update to a confirmed release newer than 2.3.0 when available. Until then, remove or disable the plugin when warranted, inspect installed themes and PHP files, and audit Subscriber and administrator activity.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H