Cross-Site Request Forgery Vulnerability in NewsBlogger Theme for WordPress
CVE-2025-12821

8.8HIGH

Key Information:

Vendor

WordPress
Status
Newsblogger
Vendor
CVE Published:
19 February 2026

What is CVE-2025-12821?

The NewsBlogger theme for WordPress has a Cross-Site Request Forgery vulnerability due to improper nonce validation within the newsblogger_install_and_activate_plugin() function. This security flaw allows unauthenticated attackers to upload arbitrary files, leading to potential remote code execution. The issue can be exploited if an administrator is tricked into making a request, such as clicking on a malicious link. This vulnerability appears to stem from an incomplete fix of a previous security issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

NewsBlogger 0.2.5.6 <= 0.2.6.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themes.trac.wordpress.org/browser/newsblogger/0.2...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucky_buddy
JSON
.