CVE-2025-26970 is a Critical (CVSS 10.0) code injection flaw in the Ark Theme Core WordPress plugin, versions before 1.71.0. Patchstack describes it as unauthenticated remote code execution. Update the plugin to 1.71.0 or later. The plugin is used by sites running the Ark theme, so check each site that has it installed, active or not, and update today.
What's affected
Affected: the Ark Theme Core plugin (slug ark-core) before version 1.71.0. Fixed: 1.71.0, according to the Patchstack entry.
The plugin supports the Ark theme from FRESHFACE. Patchstack's page title refers to version 1.70.0 and says the flaw is unauthenticated remote code execution, which agrees with the CVSS vector: network, low complexity, no privileges, no user interaction.
Patchstack lists the entry as having no vulnerability disclosure program, so there was no vendor channel for the report. Check that the theme author has released the matching theme update too, if your site uses one.
How to check if you're exposed
Check with WP-CLI:
wp plugin list --name=ark-core --fields=name,status,version,update_version
wp theme list --fields=name,status,version
If ark-core is below 1.71.0, you are in scope. You can also read the header of the main plugin file directly:
grep -m1 "Version:" wp-content/plugins/ark-core/*.php
Because the issue allows unauthenticated code execution, also look for signs of compromise on sites that ran an old version: unfamiliar PHP files under wp-content, new administrator accounts and unexpected scheduled tasks.
wp user list --role=administrator --fields=ID,user_login,user_registered
find wp-content -name "*.php" -mtime -30 | head -50
What to do now
- List all sites running the Ark theme or the
ark-coreplugin. - Update
ark-coreto 1.71.0 or later today. - If an update is not possible, deactivate the plugin until it is.
- Check for unknown administrators, changed files and new scheduled tasks on sites that were exposed.
- Rotate WordPress salts, administrator passwords and any API keys stored in the site, if you find signs of compromise.
- Take a backup before and after the update so you can compare file changes.
Why it matters
The record lists CWE-94: improper control of code generation. The plugin produces or runs code from input that was not properly limited. When an unauthenticated visitor can supply that input, the visitor controls what the server executes.
This is the highest score possible, and the reason is plain in the vector: it needs no account, no click and little skill, and the scope changes. Patchstack notes that flaws of this type are used in mass campaigns against many sites. That is its general guidance for the class and the record does not flag this CVE as exploited. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
For site owners the lesson is to remove plugins and themes you no longer use. A disabled plugin may still be reachable by URL on some setups, and an abandoned theme gets no fixes.
Quick check
Is deactivating the plugin enough?
It stops the plugin from running, which is a sound stopgap. Better still is to update, or delete the plugin if you do not need it.
How do I know if my site was affected?
Look for unknown administrator accounts, recently changed PHP files and unexpected scheduled tasks. Treat any finding as a compromise and restore from a known good backup.
Sources
Last reviewed: 19 October 2026.
