The Elastic Theme Editor WordPress plugin enables authenticated users with Subscriber-level access or higher to upload arbitrary files because of a dynamic code generation flaw in the process_theme function. By uploading malicious scripts or code to the site’s filesystem, an attacker can achieve remote code execution.

WordPress installations using Elastic Theme Editor version 0.0.3 or earlier are affected.

The CVSS score of 8.8 signals high severity, but the EPSS score of less than 1% indicates a currently low probability of exploitation. The vulnerability requires authentication, so restricting user roles reduces risk; however, once an attacker attains Subscriber privileges, uploading a PHP shell could compromise the entire site. The issue is not yet listed in the CISA KEV catalog.