High · published October 15, 2025
⚡ Just one exploit is all it takes to potentially unleash arbitrary code execution! The XStore theme for WordPress has a Local File Inclusion vulnerability that could spell disaster for your site. 🔥 Imagine a restaurant that lets anyone with a reservation sneak into the kitchen and whip up whatever they want. That’s what this vulnerability allows – authenticated users can include and run any .php file on your server, no matter how sneaky their intentions! An attacker with just Subscriber-level access could bypass access controls and execute malicious PHP code on your server. The consequences? They could access sensitive data or even gain full control over your site. This is a serious wake-up call for all WordPress users!
Imagine a restaurant that lets anyone with a reservation sneak into the kitchen and whip up whatever they want. That’s what this vulnerability allows – authenticated users can include and run any .php file on your server, no matter how sneaky their intentions! The vulnerability arises from the `theet_ajax_required_plugins_popup()` function in the XStore theme, allowing authenticated attackers to include arbitrary .php files on the server. This effectively gives them the ability to execute any PHP code, leading to potential data breaches and site compromise.
An attacker with just Subscriber-level access could bypass access controls and execute malicious PHP code on your server. The consequences? They could access sensitive data or even gain full control over your site. This is a serious wake-up call for all WordPress users! To secure your site, update the XStore theme to version 9.5.5 or later immediately. Review user permissions, especially for Subscribers, and consider tightening access controls. Regularly monitor your site for suspicious activity! You’ve got this! Act quickly, and you’ll tighten up your defenses in no time. 🛡️