Sneeit WordPress RCE flaw allows hackers to add themselves as admin – here’s how to stay safe

• WordFence disclosed critical RCE flaw (CVE-2025-6389) in Sneeit Framework plugin affecting versions ≤8.3
• Exploit allows attackers to create administrator accounts, install malicious plugins, and hijack WordPress sites
• Users are encouraged to update to v8.4, monitor for rogue admins, suspicious PHP files and malicious AJAX activity

Security researchers from WordFence have warned of a critical vulnerability in a popular plugin that allows threat actors to add themselves as administrators on WordPress websites.

In a security advisory published last week, WordFence said it found a remote code execution (RCE) flaw in the Sneeit Framework, a backend toolkit that WordPress administrators use to manage theme settings, layouts and custom features. The bug is tracked as CVE-2025-6389, received a severity rating of 9.8/10 (Critical), and affects all versions of the plugin prior to and including 8.3.