Skip to content

Start an escort site · Editorial review

EscortWP review: the version on sale ships with a backdoor

escortwp.com

EscortWP sells its WordPress escort directory theme for €99 one-time, with unlimited domains and lifetime updates. The version on sale, 3.6.2, contains a backdoor written by the vendor, tracked as CVE-2026-12685 with a CVSS score of 7.5, and no fix has been released.

Unlimited domainsOne-time paymentUnencrypted codeCrypto payments

Our verdict on EscortWP

We advise against installing EscortWP until a fixed version is released. The backdoor lets an unauthenticated attacker with a per-build key wipe all site content, and the theme sends the site URL, admin email and licence key to a remote server. Sites already running 3.6.2 or earlier should remove the theme.

EscortWP home page presenting its escort directory theme for WordPress
EscortWP

The EscortWP backdoor, CVE-2026-12685

The US National Vulnerability Database describes the EscortWP theme through 3.6.2 as distributed with a vendor-authored, obfuscated backdoor. An unauthenticated attacker who supplies a hard-coded, per-build key can permanently delete all of the site’s content, and the theme covertly sends the site URL, administrator email and licence key to a third-party server.

The issue is CVE-2026-12685, rated 7.5 (high) under CVSS 3.1. WPScan lists it as verified, with no known fix. The version sold on escortwp.com is still 3.6.2, released in March 2026. For a directory holding escort profiles, photos and advertiser accounts, losing all content ends the site.

What EscortWP offers on paper

The theme costs €99 one-time, paid by PayPal or crypto, with lifetime updates, support and installation. You can use it on unlimited domains, but agencies need one licence per client. The code is not encrypted and the theme is GPL. All sales are final, with no refunds. No legal name, postal address or registration number is published: the contact page lists only Amsterdam and an email address.

EscortWP strengths and limitations

Strengths

  • Unlimited domains for €99.
  • Unencrypted code.

Limitations

  • Vendor backdoor in the version on sale.
  • No known fix.
  • No refunds.
  • No named company.

EscortWP or PremiumPress

PremiumPress sells a WordPress escort theme for $99 one-time, usable on all your domains, with a 14-day refund and a company registered in England. It covers the same need for a WordPress escort directory.

EscortBook

EscortBook is a hosted website builder for escorts and agencies, run by Baralola Ltd. in Cyprus.

Read the review EscortBook →EscortScripts

EscortScripts sells three WordPress-based escort scripts for a one-time payment: $588 for the directory, $388 for the agency script and $114 for an independent escort…

Read the review EscortScripts →Flynax

Flynax sells a classifieds script license for $95 one-time, with unencrypted source code and installation included, and an escort agency and directory edition.

Read the review Flynax →FreeEscortSite

FreeEscortSite is a Czech escort website builder run by Web No Limit s.r.o. in Prague.

Read the review FreeEscortSite →
Sources