CVE-2026-14357: DevKit Pro WordPress Plugin Auth Bypass

CVE-2026-14357 Overview

The DevKit Pro plugin for WordPress contains a Missing Authorization vulnerability affecting all versions up to and including 2.3.0. The flaw resides in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. The function lacks both a capability check and nonce validation. Authenticated attackers with Subscriber-level access or higher can upload arbitrary theme ZIP archives containing PHP files. These archives are extracted into the web-accessible wp-content/themes/ directory, enabling remote code execution on the target site. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can achieve remote code execution by uploading a malicious theme archive to the WordPress site.

Affected Products

DevKit Pro plugin for WordPress
All versions through 2.3.0
Sites where Subscriber-level or higher registration is permitted

Discovery Timeline

2026-09-02 - CVE-2026-14357 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-14357

Vulnerability Analysis

The DevKit Pro plugin exposes an AJAX endpoint through the wp_ajax_DPDEV_install_themes WordPress hook. This hook is available to any authenticated user by default. The handler DPDEV_install_themes_func() processes theme installation requests without verifying that the calling user holds the install_themes capability. It also omits the check_ajax_referer() call that would validate a WordPress nonce and prevent cross-site request forgery.

An attacker registered as a Subscriber submits a crafted request to /wp-admin/admin-ajax.php with the action parameter set to DPDEV_install_themes. The handler accepts a theme ZIP archive supplied by the attacker and extracts it into wp-content/themes/. Because WordPress serves files from this directory over HTTP, any PHP file inside the archive becomes directly reachable. Requesting the uploaded PHP file executes attacker-controlled code under the web server user.

Root Cause

The root cause is a combination of missing access control checks. The plugin developer registered a privileged action on a hook that all authenticated users can reach, without calling current_user_can() to enforce role-based access or check_ajax_referer() to validate request origin. This aligns with CWE-862: Missing Authorization.

Attack Vector

Exploitation requires network access to the WordPress admin AJAX endpoint and a valid low-privilege account. The attacker crafts a ZIP archive that includes a valid theme style.css header alongside a PHP webshell. The archive is posted to the vulnerable AJAX action. After extraction, the attacker requests the PHP payload directly from the themes directory to trigger code execution. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2026-14357

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the action=DPDEV_install_themes parameter from non-administrator sessions.
Newly created subdirectories under wp-content/themes/ containing PHP files not shipped by known theme vendors.
Web server access log entries showing direct GET requests to unusual PHP files within wp-content/themes/.
Outbound network connections from the PHP-FPM or Apache worker process to unknown external hosts following a theme installation event.

Detection Strategies

Monitor WordPress audit logs for theme installation events initiated by users lacking the install_themes capability.
Alert on ZIP file extraction operations that write PHP files into web-accessible directories.
Correlate low-privilege user authentication events with subsequent file-write activity on the web root.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/themes/ directory to detect unauthorized additions.
Ingest WordPress and web server logs into a centralized SIEM for correlation with process and network telemetry.
Track process lineage from php-fpm or apache2 workers to identify shells or reverse connections spawned after exploitation.

How to Mitigate CVE-2026-14357

Immediate Actions Required

Update the DevKit Pro plugin to a version later than 2.3.0 once the vendor releases a fix.
Audit the wp-content/themes/ directory for unfamiliar theme folders and inspect PHP files for webshell indicators.
Review WordPress user accounts and revoke Subscriber-level access that is not required for business operations.
Rotate WordPress administrator credentials, database passwords, and API keys accessible to the web server user.

Patch Information

At the time of publication, verify the availability of a patched release on the DPlugins Download Page. Apply the fixed version to every WordPress instance running DevKit Pro. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the DevKit Pro plugin until a patched version is installed.
Disable open user registration or restrict new accounts to prevent attackers from obtaining Subscriber access.
Deploy a web application firewall rule to block requests with action=DPDEV_install_themes from non-administrator sessions.
Restrict PHP execution within the wp-content/themes/ directory using web server configuration where feasible.

bash

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "DPDEV_install_themes") {
        return 403;
    }
}