CVE Alert: CVE-2025-6990 – hogash – KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme

Risk verdict

High risk of authenticated remote code execution on affected KALLYAS themes; patch promptly to prevent potential full site compromise.

Why this matters

Attacker goals could include arbitrary server code execution, site defacement, data exfiltration, or compromise of customer transactions on WordPress e-commerce sites. Since access requires Contributor-level authentication, the impact is significant for sites where contributor accounts exist, but the barrier is insufficient on exposed admin interfaces or misconfigured roles.

Most likely attack path

An attacker with Contributor-level (or higher) access logs in and uses the TH_PhpCode widget to inject or execute code that the theme editor fails to restrict. With network-possible access, the attacker does not need physical proximity but does need valid authentication. Once code execution is achieved, they can operate within the server context (Scope unchanged), enabling lateral moves or persistence as needed.

Who is most exposed

WordPress sites using the KALLYAS theme up to version 4.24.0, especially those with contributor accounts or weak role governance, on shared or managed WordPress hosting where theme editors or code widgets are accessible.

Detection ideas

• Unexpected PHP code execution via the TH_PhpCode widget (anomalous edits in theme editor).
• Shell-like processes or PHP eval/base64_decode activity from web server logs.
• Unusual file edits in the theme directory or wp-content/uploads paths tied to the widget.
• Elevated activity after user login from contributor accounts (abnormal session patterns).
• Webshell indicators or outbound connections from the web server.

Mitigation and prioritisation

• Patch to a non-vulnerable KALLYAS release (≥ 4.24.1 or as advised by the vendor); verify integrity of theme files.
• Disable direct access to code editors for non-admins; enable WordPress DISALLOW_FILE_EDIT.
• Enforce least-privilege: restrict contributor accounts, review roles, and disable unused accounts.
• Implement primary controls: MFA for admin accounts, WAF rules targeting RCE patterns, and monitor for suspicious widget usage.
• Change-management: test patch in staging, plan a staged rollout, and audit post-patch access logs. If KEV or EPSS indicators become positive, elevate to priority 1.