PT-2025-44721 · WordPress · Kallyas

Matthew Rollings · Published 2025-11-01 · Updated 2025-11-01 · CVE-2025-6990

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kallyas versions prior to 4.24.0

Description The kallyas theme for WordPress is susceptible to Remote Code Execution through the TH PhpCode pagebuilder widget. The issue arises because the theme does not restrict access to the code editor widget for users who are not administrators. This allows authenticated attackers with Contributor-level access or higher to execute code on the server. The TH PhpCode widget is the specific component involved in this issue.

Recommendations Update kallyas to version 4.24.0 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-6990

Affected Products

Kallyas

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-6990 · Security Note
• https://twitter.com/CveTodo/status/1984538018389090564 · Twitter Post
• https://t.me/CVEtracker/36377 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1984538398237888608 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984546832278552911 · Twitter Post
• https://t.me/cveNotify/141250 · Telegram Post
• https://twitter.com/CVEnew/status/1984525168153403497 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/721d29e4-397d-4965-bd64-33bced8e5de4?source=cve · Note
• https://twitter.com/RedPacketSec/status/1984563400307847226 · Twitter Post
• https://my.hogash.com/changelog_category/kallyas-wordpress-theme · Note
• https://twitter.com/CveFindCom/status/1984540895102841083 · Twitter Post