The NewsBlogger WordPress theme is vulnerable to Cross‑Site Request Forgery because the newsblogger_install_and_activate_plugin() function does not correctly validate a security nonce. An attacker who can make a site administrator unknowingly submit a forged request can cause the theme to upload arbitrary files. Once the malicious file is in place the attacker can execute code with full administrative privileges, compromising confidentiality, integrity, and availability of the entire site. This flaw is a classic example of CWE‑352, where missing anti‑CSRF measures allow unauthorized remote actions.

Spice Themes’ NewsBlogger WordPress theme, versions up to and including 0.2.5.4. The vulnerability applies to any installation of these releases; no specific sub‑components are exempt. Users should verify the exact theme version and whether it resides on a site still using the affected releases.

The CVSS score of 8.8 places the flaw in the High severity category. The EPSS score of less than 1% indicates a low current exploitation probability, yet the vulnerability remains dangerous because exploitation requires only a forged request and no prior authentication. The flaw is not listed in CISA’s KEV catalog, but that does not reduce the risk for affected installations. In practice, an attacker would target an administrator’s browser, sending a malicious link that triggers the flawed plugin installation routine, thereby gaining remote code execution.