The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.

The WordPress application running on the remote host has a version of the 'Sneeit Framework' plugin that is prior to 8.4 and, thus, is affected by a code execution vulnerability. The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.

The WordPress Sneeit Framework Plugin installed on the remote host is affected by a Remote Code Execution vulnerability due to insufficient input validation in the sneeit_articles_pagination_callback() function, which accepts user input and passes it through the call_user_func() function. This allows unauthenticated attackers to execute arbitrary code on the server.

ID	Name	Product	Family	Type	Severity
278112	WordPress Plugin 'Sneeit Framework' < 8.4 Code Execution	Nessus	CGI abuses	Remote	critical
115051	Sneeit Framework Plugin for WordPress < 8.4 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical

Detections

Analytics

CVE-2025-6389

critical

Tenable Plugins

critical

critical