Plateforme
wordpress
Composant
ark-core
Corrigé dans
1.71.1
CVE-2025-26970 identifies a Remote Code Execution (RCE) vulnerability within the FRESHFACE Ark Theme Core plugin for WordPress. This flaw allows attackers to inject arbitrary code, leading to complete server compromise. The vulnerability impacts versions from 0.0.0 through 1.71.0, and a patch is available in version 1.71.0.
The RCE vulnerability in Ark Theme Core presents a severe risk. An attacker could leverage this flaw to execute arbitrary commands on the web server hosting the WordPress site. This could lead to data theft, website defacement, malware installation, or complete system takeover. Given the plugin's potential usage on numerous WordPress sites, the blast radius is significant. Successful exploitation could also enable lateral movement within the network if the server has access to other resources. The ability to inject code directly bypasses typical security controls, making it a particularly dangerous vulnerability.
CVE-2025-26970 was publicly disclosed on March 3, 2025. While no public proof-of-concept (POC) code has been released at the time of writing, the RCE nature of the vulnerability makes it a high-priority target for exploitation. The EPSS score is likely to be high, indicating a significant probability of exploitation. It is not currently listed on the CISA KEV catalog.
Websites utilizing the Ark Theme Core plugin, particularly those running older, unpatched versions (0.0.0–1.71.0), are at significant risk. Shared hosting environments where multiple websites share the same server are especially vulnerable, as a compromise of one site could potentially impact others. Sites with limited security monitoring or outdated WordPress installations are also at higher risk.
• wordpress / composer / npm:
grep -r "ark-core" /var/www/html/• wordpress / composer / npm:
wp plugin list | grep ark-core• wordpress / composer / npm:
wp plugin update ark-core --version=1.71.0• generic web: Check WordPress plugin directory for mentions of 'ark-core' and associated vulnerabilities. • generic web: Review WordPress error logs for any unusual code execution patterns or errors related to the Ark Theme Core plugin.
disclosure
Statut de l'Exploit
EPSS
0.24% (percentile 47%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2025-26970 is to immediately upgrade the Ark Theme Core plugin to version 1.71.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider disabling the plugin entirely. As a temporary workaround, implement strict input validation and sanitization on any user-supplied data processed by the plugin. Web Application Firewalls (WAFs) can be configured to detect and block suspicious code injection attempts, although this is not a substitute for patching. Monitor WordPress logs for unusual activity or code execution attempts.
Mettez à jour le plugin Ark Theme Core à la version 1.71.0 ou supérieure pour atténuer la vulnérabilité d'exécution de code à distance non authentifiée. Vérifiez les mises à jour disponibles dans le tableau de bord d'administration de WordPress ou téléchargez la dernière version depuis le dépôt officiel de WordPress.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2025-26970 is a critical Remote Code Execution (RCE) vulnerability affecting the Ark Theme Core WordPress plugin, allowing attackers to execute arbitrary code.
You are affected if you are using Ark Theme Core versions 0.0.0 through 1.71.0. Check your plugin versions immediately.
Upgrade the Ark Theme Core plugin to version 1.71.0 or later. If immediate upgrade is not possible, disable the plugin.
While no public exploits are currently known, the vulnerability's severity suggests it is likely to be targeted by attackers.
Refer to the FRESHFACE website and WordPress plugin repository for the official advisory and update information.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.