Arbitrary File Upload Vulnerability in NewsBlogger Theme for WordPress

CVE-2025-1304

What is CVE-2025-1304?

The NewsBlogger theme for WordPress contains a significant security flaw due to inadequate capability checks in the newsblogger_install_and_activate_plugin() function. This vulnerability allows authenticated users with subscriber-level access and above to upload arbitrary files to the server, potentially leading to remote code execution. This is particularly concerning for site administrators as it opens the door for attackers to compromise the integrity of the website and execute harmful scripts.

References