High · published November 1, 2025
🚨 A remote code execution vulnerability in the Kallyas theme can turn any Contributor-level user into an admin-level attacker! 🔥 Think of it like a restaurant where the waitstaff can access the kitchen. If a Contributor has access to the code editor widget, they could potentially cook up malicious code and serve it right from the server — not exactly a recipe for success! This flaw allows attackers with just Contributor access to execute arbitrary code on the server, posing a serious threat to your website's integrity. An unscrupulous user could modify, delete, or even steal sensitive data — absolutely devastating for any site owner!
Think of it like a restaurant where the waitstaff can access the kitchen. If a Contributor has access to the code editor widget, they could potentially cook up malicious code and serve it right from the server — not exactly a recipe for success! The Kallyas theme's `TH_PhpCode` pagebuilder widget lacks proper access restrictions, allowing authenticated users with Contributor access or higher to run arbitrary PHP code on the server, leading to remote code execution.
This flaw allows attackers with just Contributor access to execute arbitrary code on the server, posing a serious threat to your website's integrity. An unscrupulous user could modify, delete, or even steal sensitive data — absolutely devastating for any site owner! To protect your site, immediately update the Kallyas theme to version 4.24.1 or later. Review your user roles and permissions to ensure that only trusted users have access to sensitive features like the code editor widget. Consider disabling this feature for lower-level users until a thorough audit is complete. You've got this! Follow these steps and your site will be fortified in no time. 🛡️