The SpicePress theme contains a Cross‑Site Request Forgery flaw that lets an unauthenticated attacker trick an authenticated WordPress user into uploading a web shell through the plugin installation interface. This flaw enables the attacker to gain full administrative access to the site and execute arbitrary code on the server, compromising confidentiality, integrity and availability. The weakness is identified as CWE‑352.

WordPress sites using the SpicePress theme from any version up to and including 2.3.2.5 are affected. The vulnerability is present in the theme component supplied by spicethemes. The issue exists regardless of other themes or plugins being present.

The vulnerability can be exploited by sending a crafted request to a user who is logged in and has permission to install plugins. An attacker does not need additional privilege escalation beyond the normal admin context, making the attack path straightforward. No formal CVSS or EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because of the potential for remote code execution, the risk to affected sites is high if no countermeasures are applied.