The Blogzee theme for WordPress contains an unrestricted upload flaw that fails to validate or filter file types, allowing an attacker to upload files with dangerous extensions or content. This defect can be leveraged to place malicious payloads – such as PHP backdoors – onto the web server, resulting in full compromise of the application and potentially the underlying host. The weakness is formally categorized as CWE‑434, which signifies an unfiltered file upload that permits the execution of arbitrary code.

All installations of the Blogzee theme version 1.0.5 or earlier are affected. The theme is distributed by blazethemes and is used on any WordPress site that has not applied an update beyond 1.0.5. No specific sub‑versions are listed beyond the maximum limit of 1.0.5, so any instance older than that threshold remains vulnerable.

The score of 9.9 on the standard CVSS indicates a high severity vulnerability that provides remote attackers with potential to execute code. However, the EPSS score of less than 1% suggests that, in the general population of WordPress sites, exploitation attempts are currently rare. The vulnerability is not present in the CISA KEV catalog, meaning no confirmed widespread exploitation reports are known. Attackers would need only to access the file upload mechanism – typically a publicly reachable form – to supply a malicious file, making it a straightforward path for exploitation if the site allows unauthenticated users or poorly privileged users to upload content.