The NewsBlogger WordPress theme contains a missing capability check in the function that installs and activates the plugin, allowing authenticated users with subscriber-level permission or higher to upload any file type to the server. This flaw enables an attacker to place malicious code on the site, potentially leading to remote code execution, data theft, or site defacement. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress installation by granting the attacker the means to run code with the webserver’s privileges.

WordPress websites that use the NewsBlogger theme version 0.2.5.1 or earlier are affected. The issue exists in all prior releases up to and including v0.2.5.1. Site administrators should verify the theme version via the WordPress dashboard or theme files.

The CVSS score of 8.8 indicates a high severity attack. An EPSS score of 2% suggests that the probability of exploitation is low but not negligible. The vulnerability is not listed in CISA’s KEV catalog, so no known public exploits are documented. The attack vector requires authentication; an attacker must have at least subscriber-level access. Once authenticated, the attacker can upload arbitrary files that can be executed by the webserver, leading to full remote code execution on the host.