The Vayu X theme before version 1.0.6 contains an AJAX endpoint that performs no capability check and reveals the protecting nonce to any logged‑in user. Because the nonce is exposed, an attacker who only has any authenticated role—such as a subscriber—can request the endpoint and cause WordPress to download and activate any plugin from the WordPress.org repository. The result is the ability to deploy arbitrary code with the privileges of the web server, leading to full site compromise, data leakage, or defacement.

Any WordPress installation using the Vayu X theme, version lower than 1.0.6, regardless of other plugins or themes. The issue exacts on the theme’s bundled AJAX actions available to all authenticated users.

The vulnerability requires a user to be authenticated, but no higher privileges are needed. From any logged‑in user, including a subscriber, the exposed nonce and AJAX endpoint can be invoked to install and activate any plugin from WordPress.org. The CVSS score of 7.1 reflects this high impact with moderate exploitation complexity. The EPSS score of <1% indicates a very low probability of exploitation today, and it is not listed in the CISA KEV catalog. Nonetheless, successful exploitation would allow arbitrary code execution with web‑server privileges, leading to full site compromise, data leakage, or defacement.