High severity8.8NVD Advisory· Published Nov 1, 2025· Updated Apr 15, 2026
CVE-2025-6990
CVE-2025-6990
Description
The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the TH_PhpCode pagebuilder widget. This is due to the theme not restricting access to the code editor widget for non-administrators. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Package: https://wordpress.org/themes/kallyas
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.