Obfuscated Backdoor in EscortWP Theme Exposes WordPress Users to Data Loss
CVE-2026-12685
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-12685?
The EscortWP WordPress theme, specifically version 3.6.2, contains a vendor-created obfuscated backdoor allowing unauthenticated attackers to execute damaging actions on the site. This vulnerability enables malicious actors to delete all content permanently by utilizing a hard-coded, per-build key. Additionally, sensitive site information, including the site URL, administrator email address, and license key, is covertly transmitted to an external server, posing a significant risk to user privacy and data integrity.
Affected Version(s)
escortwp 0 <= 3.6.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.