The vulnerability resides in the Newscrunch WordPress theme’s install and activate function, which fails to validate or incorrectly validates a nonce. This deficiency allows an unauthenticated actor to forge a request that an administrator will execute by clicking a link or performing a similar action. Once the request is processed, the attacker can upload any file to the theme’s directory, thereby creating a pathway for arbitrary code execution, defacement, or placement of malicious scripts. The weakness reflects a classic CSRF flaw (CWE-352).

WordPress sites that employ the Newscrunch theme from Spicethemes in version 1.8.4 or earlier are directly affected. Administrators using any older release of the theme, regardless of other plugins or customizations, remain vulnerable until the theme is upgraded to a version that implements proper nonce checks.

The CVSS score of 8.8 classifies the issue as high severity, yet the EPSS score of 2% suggests that exploitation is currently unlikely on a large scale. Because the attack requires an administrative user to unknowingly submit the forged request, the likelihood of successful exploitation depends on convincing the administrator to click a malicious link. The vulnerability is not listed in the CISA KEV catalog, indicating that no known active exploits have been reported at this time. Nevertheless, given the high impact of an arbitrary file upload, it is advisable to treat this as a risk worth addressing immediately.