The vulnerability exists in the TH_PhpCode pagebuilder widget of the Kallyas WordPress theme. Due to the theme not restricting access to this code editor widget for users who are not administrators, an authenticated attacker with Contributor‑level privileges or higher can insert and execute arbitrary PHP code on the web server. This grants the attacker full control over the server, allowing data exfiltration, lateral movement, and complete site takeover. The weakness is identified as an unsafe code injection (CWE‑94).

All released versions of the hogash KALLYAS Creative eCommerce Multi‑Purpose WordPress Theme up to and including version 4.24.0 are affected. Users running any of these versions are vulnerable; only versions above 4.24.0 without the TH_PhpCode widget or with restricted privileges are safe.

The CVSS score of 8.8 classifies the vulnerability as critical, yet the EPSS score of less than 1% indicates a low probability of exploitation. Because the flaw requires authenticated access at the Contributor level, attackers must either compromise credentials or abuse existing legitimate accounts. The vulnerability is not listed in the CISA KEV catalog, but its ability to execute code remotely poses a severe threat if exploited.