Missing Authorization Vulnerability in DevKit Pro Plugin for WordPress

CVE-2026-14357

What is CVE-2026-14357?

The DevKit Pro plugin for WordPress has a vulnerability stemming from a lack of proper capability checks and nonce validation in the DPDEV_install_themes_func(). This weakness is especially concerning as it allows authenticated users, including those with Subscriber-level access, to exploit this flaw. By leveraging this vulnerability, attackers can install malicious theme ZIP packages that could contain executable PHP files. Once these files are extracted into the publicly accessible wp-content/themes/ directory, they may pave the way for remote code execution, leading to potential compromise of the WordPress site.

References