The DevKit Pro WordPress plugin has a missing authorization check that allows any authenticated user with Subscriber level or higher to upload theme ZIP files. The upload routine does not validate the user’s capability or a nonce, and it extracts the archive directly into the wp-content/themes directory. If the ZIP contains malicious PHP files, those files are placed in a web‑accessible location, creating a path for an attacker to execute arbitrary code on the site.

The vulnerability affects the DevKit Pro plugin, versions 2.3.0 and earlier, developed by dplugins. Users running these versions on any WordPress installation are susceptible to the exploit.

With a CVSS score of 8.8, this flaw is classified as high severity. The EPSS score is not provided, indicating no publicly available exploitation data at the time of analysis. The vulnerability is not listed in CISA KEV. It can be leveraged by any authenticated user who has Subscriber role or above. By exploiting the missing capability check and nonce validation, the attacker can upload a malicious theme archive and achieve remote code execution, compromising confidentiality, integrity, and availability of the affected site.