CVE-2026-14357: DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc() function registered on the wpajaxDPDEVinstallthemes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DevKit Pro WordPress pluginto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Modify DPDEV_install_themes_func() (hooked to the wp_ajax_DPDEV_install_themes action) to include a capability check and to validate the nonce before allowing authenticated users to install themes.
DevKit Pro (WordPress) - DPDEV_install_themes_func() wp_ajax_DPDEV_install_themes capability check and nonce validation = Add required capability check and validate nonce for theme installation; reject requests lacking proper authorization or nonce
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or any higher role. No user interaction is required.
Are sites using the affected plugin exposed by default?
The vulnerable AJAX action lacks both a capability check and nonce validation, so any affected installation where low-privileged users can authenticate may be exposed. The issue affects DevKit Pro versions up to and including 2.3.0.
What is the likely impact of successful exploitation?
A low-privileged user can install an arbitrary theme ZIP containing PHP files. Those files are extracted under the web-accessible wp-content/themes/ directory, which may enable remote code execution.
How can administrators determine whether exploitation may have occurred?
Review installed theme directories for unexpected or recently added theme packages and PHP files under wp-content/themes/. Also review WordPress accounts for untrusted Subscriber-level or higher users, since authenticated access is required.