Cyber Resilience

CVE-2025-26970

CriticalRCE

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0025 48.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26970 is a critical-severity Code Injection (CWE-94) vulnerability in Arktheme The Ark. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26970 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified as CWE-94, in the FRESHFACE Ark Theme Core (ark-core) WordPress plugin. This issue affects all versions from n/a through those prior to 1.71.0. Published on 2025-03-03, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critical.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables code injection, leading to remote code execution (RCE) with high impacts on confidentiality, integrity, and availability, and a changed scope.

The Patchstack advisory details this as an unauthenticated RCE vulnerability specifically in Ark Theme Core plugin version 1.70.0 and earlier versions. Mitigation requires updating to version 1.71.0 or later.

EU & UK References

Vulnerability details

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme Core: from n/a through < 1.71.0.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote code injection leading to RCE in a public-facing WordPress plugin directly maps to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94
CVE-2026-42555Shared CWE-94
CVE-2025-65037Shared CWE-94

Affected Assets

arktheme
the ark
≤ 1.70.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates code injection (CWE-94) by requiring validation and sanitization of inputs to the Ark Theme Core plugin.

SI-2 Flaw Remediation good match
prevent

Ensures timely patching of the specific flaw in Ark Theme Core versions prior to 1.71.0 to prevent unauthenticated RCE.

SI-3 Malicious Code Protection partial match
preventdetect

Provides malicious code protection mechanisms that can block or detect execution of injected code leading to RCE.

References