CVE-2025-6389
Published: 25 November 2025
Summary
CVE-2025-6389 is a critical-severity Code Injection (CWE-94) vulnerability in Themeforest (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Sneeit Framework plugin for WordPress is vulnerable to remote code execution in all versions through 8.3. The flaw resides in the sneeit_articles_pagination_callback function, which accepts attacker-controlled input and passes it directly to call_user_func, enabling arbitrary PHP code execution under CWE-94. The issue carries a CVSS 3.1 score of 9.8 with network attack vector, no authentication, and full confidentiality, integrity, and availability impact.
Unauthenticated remote attackers can invoke the vulnerable callback to run arbitrary code on the hosting server. Successful exploitation allows actions such as installing backdoors or creating new administrative accounts without any user interaction.
The two referenced sources point to the vendor release notes and a Wordfence threat-intel entry, but supply no explicit patch version or mitigation steps beyond the general implication that the affected plugin must be updated. EPSS scores have remained low, moving only from 0.0118 to a peak of 0.0142 with no indication of emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199531
Vulnerability details
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This…
more
makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote code execution in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the RCE vulnerability in Sneeit Framework plugin versions up to 8.3 by requiring timely flaw identification, reporting, and patching per advisories.
Enforces validation of unsanitized user input to the sneeit_articles_pagination_callback() function before passing to call_user_func(), preventing arbitrary PHP code execution.
Verifies software and information integrity to detect unauthorized changes like backdoors or admin accounts created via exploitation of the RCE vulnerability.