Description
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sneeit | Sneeit Framework | ≤ 8.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
itsismarcos/SneeitScanner-CVE-2025-6389 ★ 1 · Dec 10, 2025
SneeitScanner - PoC & Scanner para RCE não autenticada no Sneeit Framework (CVE-2025-6389)
-
Nxploited/CVE-2025-6389 ★ 0 · Apr 18, 2026
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func http/cves/2025/CVE-2025-6389.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.