Hackers Actively Exploiting Worpress Plugin Vulnerability to Execute Remote Code

A critical remote code execution vulnerability has been identified in the Sneeit Framework WordPress plugin, which is currently being exploited by threat actors. This vulnerability affects thousands of websites globally and is tracked as CVE-2025-6389, with a CVSS score of 9.8. It affects versions 8.3 and earlier of the plugin, which has approximately 1,700 active installations.

The vulnerability was discovered on June 10, 2025, and subsequently reported to the vendor. A patched version was released on August 5, 2025, and the vulnerability was publicly disclosed on November 24, 2025. Exploitation attempts by threat actors began on the day of public disclosure, targeting unpatched installations.

Wordfence security analysts identified and documented the exploitation campaign, reporting that the Wordfence Firewall has blocked over 131,000 exploit attempts since the disclosure. Premium users received firewall protection on June 23, 2025, while free users were protected from July 23, 2025. However, unpatched versions remain vulnerable.

The vulnerability arises from insufficient input validation in the sneeitarticlespaginationcallback function, which processes user-supplied parameters without restriction. Attackers exploit this by sending specially crafted AJAX requests to the wp-admin/admin-ajax.php endpoint, enabling the execution of arbitrary PHP code on the server.

Exploitation Mechanics and Attack Vectors

Initial exploitation involves sending POST requests with malicious code through the AJAX handler. Reconnaissance often precedes these attacks, using phpinfo functions to gather server information. Attackers may create unauthorized administrator accounts or upload malicious PHP files for persistent access.

Common attack vectors include the use of the wp_insert_user function to create new administrative accounts. Alternative methods involve uploading malicious PHP files, such as xL.php, Canonical.php, and tijtewmg.php , which contain functionality for directory scanning, file management, and permission modification.

Attribute Details

Vulnerability Name Unauthenticated Remote Code Execution in sneeitarticlespaginationcallback

CVE ID CVE-2025-6389

CVSS Score 9.8 (Critical)

Affected Software Sneeit Framework

Affected Versions 8.3 and earlier

Patched Version 8.4

Discovery Date June 10, 2025

Vendor Patch Released August 5, 2025

Public Disclosure Date November 24, 2025

Active Exploitation Started November 24, 2025

Estimated Installations 1,700+ active installations

Root Cause Insufficient input validation in sneeitarticlespaginationcallback function

Attack Vector AJAX requests to wp-admin/admin-ajax.php endpoint

Impact Complete site compromise, unauthorized admin account creation, backdoor installation

Recommendation Update to version 8.4 or later immediately

Website owners are advised to update to Sneeit Framework version 8.4 or later to address this critical vulnerability and prevent potential site compromise and data theft.

Based on reporting by Cyber Security News.