by Kastro
Paper/Archive/CVE-2025-1307

CVE-2025-1307

spicethemes Newscrunch — Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.2.822 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected

ProductAffectedFixed inSource
Newscrunch≤ 1.8.4–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/b55567e9-24e6-4738-b7f7-b95b541e6067?source=cverefthemes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486refthemes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261789%40newscrunch&new=261789%40newscrunch&sfp_email=&sfph_mail=