A critical code injection vulnerability in the Streamit WordPress theme allows unauthenticated attackers to execute arbitrary functions and gain full system control.

The theme fails to perform authorization or nonce verification on an AJAX route, allowing unauthenticated attackers to invoke arbitrary PHP functions. This mechanism can be leveraged to create administrator accounts or execute arbitrary code on the underlying web server.

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. Successful exploitation grants an attacker full control over the WordPress installation, enabling data theft, site defacement, and the installation of persistent backdoors for long-term access.

Immediate Action: Update the Streamit theme to the latest available version provided by the vendor. If an update is not immediately available, deactivate the theme.

Proactive Monitoring: Inspect the WordPress user database for unauthorized administrator accounts and review server access logs for requests to AJAX endpoints associated with the theme.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the theme's AJAX endpoints.

Public Exploit Available: Unknown

This vulnerability is exceptionally severe and serves as a prime target for automated attacks against WordPress sites. It is imperative that administrators update the theme immediately or remove it from the environment to mitigate the risk of full site compromise.