CVE-2026-12685 describes a hidden functionality vulnerability (CWE-912) in the EscortWP WordPress theme through version 3.6.2. The theme includes an obfuscated backdoor implemented by the vendor that can be triggered by supplying a hard-coded, per-build key. Exploiting this backdoor enables an unauthenticated attacker to permanently delete all content on the affected site. Furthermore, the backdoor exfiltrates sensitive information including the site URL, administrator email address, and license key to an external third-party server. There is no CVSS score assigned and no known exploits in the wild at this time. No patch or official remediation has been disclosed.

An attacker with knowledge of the hard-coded key can cause permanent data loss by deleting all site content. Sensitive site information including URL, admin email, and license key is leaked to a third party, potentially enabling further attacks or misuse of the license. The vulnerability affects site availability and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider discontinuing use of the affected theme version or replacing it with a trusted alternative. Monitor for vendor updates regarding patches or official mitigations.