The DevKit Pro plugin for WordPress contains a critical authorization flaw that allows authenticated users to achieve remote code execution.

The vulnerability exists due to a missing capability check and nonce validation in the DPDEV_install_themes_func function. This flaw allows any authenticated user, including those with minimal Subscriber-level privileges, to upload and install arbitrary ZIP files containing malicious PHP code.

A successful exploit grants an attacker the ability to execute arbitrary code on the underlying web server. This leads to a complete compromise of the WordPress environment, potentially resulting in unauthorized data access, site defacement, and the deployment of persistent backdoors. Given the high CVSS score of 8.8, this vulnerability presents a significant risk to the integrity and availability of the host infrastructure.

Immediate Action: Update the DevKit Pro plugin to version 2.3.1 or later immediately to apply the necessary capability checks.

Proactive Monitoring: Review web server access logs for suspicious requests to the wp-admin/admin-ajax.php endpoint or unexpected file creation within the wp-content/themes directory.

Compensating Controls: If an immediate update is not feasible, deactivate the DevKit Pro plugin to eliminate the vulnerable attack surface until a patch can be applied.

Public Exploit Available: No

The severity of this vulnerability, combined with the ease of exploitation for authenticated users, necessitates immediate attention. Administrators must prioritize updating the DevKit Pro plugin to version 2.3.1 across all affected WordPress instances to prevent potential remote code execution and full system compromise.