Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks

A critical security flaw in the Sneeit Framework plugin for WordPress is being actively exploited in the wild, according to Wordfence. The remote code execution vulnerability, CVE-2025-6389 (CVSS 9.8), affects all versions prior to and including 8.3 and was patched in version 8.4 released on 5 August 2025; the plugin has more than 1,700 active installations.

In-the-wild exploitation began on 24 November 2025, with Wordfence blocking over 131,000 attempts targeting the flaw and 15,381 attack attempts recorded in the past 24 hours. Attacks include unauthenticated exploitation to execute code and create a malicious administrator account by calling an arbitrary PHP function such as wp_insert_user, potentially redirecting visitors or injecting backdoors.

Some campaigns use specially crafted HTTP requests to the /wp-admin/admin-ajax.php endpoint to create admin users and upload malicious PHP files, including ones named xL.php, Canonical.php, .a.php, and simple.php, with an .htaccess file downloaded from an external server to help maintain access.