Critical WordPress Flaw (CVE-2025-6389) Under Active Exploitation Allows Unauthenticated RCE

A critical Remote Code Execution vulnerability in the Sneeit Framework, a core plugin bundled with multiple premium WordPress themes, is being actively exploited and allows unauthenticated code execution via the sneeit_articles_pagination_callback() function. The flaw, CVE-2025-6389, arises because the function accepts user input and passes it through call_user_func() without proper sanitisation, enabling an attacker to call arbitrary PHP functions with supplied parameters.

According to Wordfence researchers, attackers started exploiting the issue the same day on 24 November 2025, with the Wordfence Firewall already blocking over 131,000 exploit attempts targeting this vulnerability. The exploit campaign has included attempts to add malicious administrative user accounts and to upload PHP backdoors, including files named xL.php, Canonical.php or .a.php, often disguising themselves as legitimate system files. The vendor has patched the flaw in version 8.4, but versions up to and including 8.3 remain at risk.