Introduction
A single Contributor-level account on a WordPress site running Kallyas up to 4.24.0 can lead to full server compromise. Authenticated users can execute arbitrary PHP code through the TH_PhpCode widget, which exposes sensitive data and gives them persistent access.
About Kallyas and Hogash Studio: Kallyas is a premium multi-purpose WordPress theme developed by Hogash Studio and sold on ThemeForest. It is widely used for eCommerce and business sites, with thousands of active installations. Because so many sites run it, a vulnerability in its codebase has an unusually wide reach.
Technical Information
CVE-2025-6990 is a code injection vulnerability (CWE-94) in the Kallyas WordPress theme's TH_PhpCode pagebuilder widget. The widget is designed to let administrators add custom PHP code blocks to pages. Because it is missing capability checks, any authenticated user with Contributor access or higher can add the widget to a page and supply arbitrary PHP code.
When the page is saved or previewed, the server executes that PHP code with the privileges of the web server process. An attacker can use this to:
- Create new administrator accounts
- Install backdoors or malicious plugins
- Read sensitive files such as wp-config.php
- Exfiltrate database credentials or user data
- Modify or deface site content
The root cause is that no authorization logic restricts the TH_PhpCode widget to administrators. The widget's documentation acknowledges how powerful it is, but the implementation did not enforce role-based access control, so Contributors and above could use it.
No public code snippets are available, but exploitation is straightforward. An attacker with Contributor credentials:
- Logs in.
- Creates or edits a page.
- Adds the TH_PhpCode widget.
- Injects malicious PHP code.
The code executes when the page is rendered.
Affected Systems and Versions
- Product: Kallyas WordPress Theme by Hogash Studio
- Affected versions: All versions up to and including 4.24.0
- Vulnerable configuration: Any WordPress site with the Kallyas theme <= 4.24.0 installed and at least one user with Contributor or higher access
Vendor Security History
- CVE-2025-6991: Local File Inclusion in TH_LatestPosts4 widget (Contributor+)
- CVE-2025-6989: Arbitrary Folder Deletion
- Broken access control in Kallyas <= 4.22.0
- Vendor released version 4.23.0 to restrict TH_PhpCode to administrators and fix related issues
- The vendor has patched promptly, but flaws in access control keep recurring
