Critical WordPress Flaw (CVE-2025-6389, CVSS 9.8) Under Active Exploitation Allows Unauthenticated RCE

A critical vulnerability (CVE-2025-6389) has been discovered in the Sneeit Framework, a WordPress plugin used in themes like FlatNews, allowing unauthenticated Remote Code Execution (RCE) with a CVSS score of 9.8. This flaw affects versions 8.3 and earlier, enabling attackers to execute arbitrary code without authentication. The vulnerability is located in the sneeit_articles_pagination_callback() function, which improperly handles user input.

Exploitation can lead to severe consequences, including site takeover and backdoor installation. Wordfence has reported active exploitation attempts, blocking 491 attacks in a single day. A patch has been released in version 8.4 of the Sneeit Framework.