- WordFence disclosed critical RCE flaw (CVE-2025-6389) in Sneeit Framework plugin, affecting versions ≤8.3
- Exploitation allows attackers to create admin accounts, install malicious plugins, and hijack WordPress sites
- Users urged to update to v8.4, monitor for rogue admins, suspicious PHP files, and malicious AJAX activity
Security researchers from WordFence have warned about a critical-severity vulnerability in a popular plugin which allows threat actors to add themselves as admins on WordPress sites.
