CVE-2025-26936 – WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability

https://notcve.org/view.php?id=CVE-2025-26936

24 Feb 2025 — Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Fresh Framework allows Code Injection. This issue affects Fresh Framework: from n/a through 1.70.0. The Fresh Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.70.0. This makes it possible for unauthenticated attackers to execute code on the server. • https://patchstack.com/database/wordpress/plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •