CVE-2026-12685 identifies a hidden backdoor in the EscortWP WordPress theme versions up to 3.6.2. The backdoor is obfuscated and vendor-authored, enabling an unauthenticated attacker who knows a hard-coded, per-build key to permanently delete all content on the affected site. Furthermore, the backdoor exfiltrates the site URL, administrator email address, and license key to an external third-party server. This represents a significant integrity risk to affected sites and a privacy breach due to unauthorized data transmission. No official patch or remediation guidance is currently provided by the vendor.

The vulnerability allows unauthenticated attackers to cause permanent deletion of all site content, severely impacting site integrity and availability. Additionally, sensitive information including site URL, admin email, and license key is covertly transmitted to a third party, compromising confidentiality and potentially enabling further attacks or misuse. There is no indication of direct confidentiality loss of user data beyond the stated information. The CVSS score of 7.5 reflects a high impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider discontinuing use of the EscortWP theme version 3.6.2 and earlier or removing the theme entirely. Monitoring for unusual outbound network traffic may help detect data exfiltration attempts. Avoid using hard-coded keys and verify theme integrity from trusted sources.