PT-2025-9479 · Unknown · Ark Theme Core

Rafie Muhammad · Published 2025-03-03 · Updated 2025-04-14 · CVE-2025-26970

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ark Theme Core versions 1.70.0 and earlier

Description The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows for code injection in the NotFound Ark Theme Core.

Recommendations For versions 1.70.0 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-26970

Affected Products

Ark Theme Core

References · 10

• https://osv.dev/vulnerability/CVE-2025-26970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26970 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/ark-core/vulnerability/wordpress-ark-theme-core-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/19370 · Telegram Post
• https://twitter.com/dailycve/status/1901711963203203540 · Twitter Post
• https://twitter.com/CVEnew/status/1896767637801046084 · Twitter Post
• https://t.me/cvenotify/119019 · Telegram Post
• https://t.me/cvenotify/115078 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/ark-core/vulnerability/wordpress-ark-theme-core-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1896561809596780771 · Twitter Post