The vulnerability is an unauthenticated flaw in the Streamit WordPress theme that relies on an unsecured AJAX endpoint. The endpoint accepts user supplied data to call any PHP function with any argument array, giving attackers the ability to perform arbitrary actions such as creating administrator accounts or executing code on the server. The flaw is classified as a code injection weakness.

All installations of the Streamit theme through version 4.5.0 are affected, including the product belonging to the vendor Streamit.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1 % signals a low current exploitation probability. The flaw is not yet listed in the CISA KEV catalog. Attackers could exploit it by sending an unauthenticated HTTP POST request to the vulnerable AJAX route, which does not perform any authorization or nonce checks, and specifying the desired PHP function and arguments.