Loading vulnerability…
Unauthenticated Remote Code Execution in Sneeit Framework for WordPress
CVE-2025-6389 is a remote code execution vulnerability in the Sneeit Framework WordPress plugin affecting versions through 8.3. The sneeit_articles_pagination_callback() function accepts attacker-controlled input and passes it to call_user_func(), enabling unauthenticated execution of code on the hosting server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker can execute code on the affected server. This access can be used to implant backdoors and create WordPress administrative accounts, enabling persistent control of the site.
If you can’t patch tonight, do this now.
If an update cannot be applied immediately, disable the Sneeit Framework plugin until it can be updated. Inspect affected WordPress installations for unauthorized administrator accounts, backdoors, and other unexpected server-side changes, and remove identified persistence.
Patch, then assume compromise.
Update Sneeit Framework to version 8.4 or later. Version 8.4, released on August 5, 2025, patches the vulnerability.
6 exploits validated by Mallory's analysis.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.