The Elastic Theme Editor plugin for WordPress contains a code injection vulnerability due to insufficient validation in its dynamic code generation within the process_theme function. This allows authenticated attackers with low privilege (Subscriber or above) to upload arbitrary files to the affected server. Such file uploads can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is tracked as CVE-2025-12637 with a CVSS 3.1 score of 8.8, indicating high severity. No patch or official remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows authenticated users with minimal privileges to upload arbitrary files, potentially leading to remote code execution on the affected WordPress site. This compromises the confidentiality, integrity, and availability of the system. Given the low privilege required and the high CVSS score, the impact is significant for affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or monitor user roles that have access to the Elastic Theme Editor plugin, especially Subscriber-level accounts and above. Consider disabling or removing the plugin if it is not essential. Avoid granting unnecessary privileges to users and review file upload permissions on the server.