Skip to content
Sign in
8.8 High

CVE-2025-1304 The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the…

Description

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products and versions

Product Affected versions Fixed in
NewsBlogger 0.2 earliest → 0.2.5.1 No fix stated

Other CVEs of NewsBlogger

The 3 CVEs of NewsBlogger →
CVE-2025-12821 The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9 8.8 High CVE-2025-1305 The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… 8.8 High
Track this CVE