blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-6389

CRITICAL 9.8 CVSS 3.1
Published
November 25, 2025
Last modified
October 18, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-94
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.

Affected products and versions

  • Sneeit Sneeit Framework — Up to and including 8.3

References

  • themeforest.net https://themeforest.net/item/flat-news-responsive-magazine-wordpress-theme/6000513#item-description__release-notes
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ed8a39-50b0-4acf-9054-ba389c49f345?source=cve
  • nvd.nist.gov Official NVD record