Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-02 | 1 | Disclosure1 |
| 2026-09-03 | 1 | General1 |
⚠️ Vulnerabilidades en Complementos de WordPress ❗ CVE-2026-9055 ❗ CVE-2026-78657 ❗ CVE-2026-14357 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-complementos-de-wordpress/ https://t.co/na9Tq4jZVC
Post summary
The post lists three WordPress plugin CVEs and directs readers to a CERT page for more information, without providing deeper technical details or exploitation context.
CVE-2026-14357 The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and miss… https://www.cve.org/CVERecord?id=CVE-2026-14357
Post summary
The post announces a missing authorization vulnerability in DevKit Pro WordPress plugin, providing technical detail but no PoC, exploit, or patch information.