Cyber Posture

CVE-2025-1306

High

Published: 04 March 2025

Published
04 March 2025
Modified
05 March 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0155 81.5th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution.

Security Summary

CVE-2025-1306, published on 2025-03-04, is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352, affecting the Newscrunch theme for WordPress in all versions up to and including 1.8.4. The flaw arises from missing or incorrect nonce validation in the newscrunch_install_and_activate_plugin() function, enabling unauthenticated attackers to upload arbitrary files through a forged request if they can deceive a site administrator.

Attackers require no privileges (PR:N) and can exploit this over the network (AV:N) with low attack complexity (AC:L), but it depends on user interaction such as an administrator clicking a malicious link (UI:R). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.8 in an unchanged scope (S:U), potentially allowing full file upload capabilities on the targeted WordPress site.

Advisories from Wordfence and the WordPress theme trac repository, including functions.php at line 486 and changeset 261789 for the Newscrunch theme, provide details on the vulnerability and associated fixes.

Details

CWE(s)
CWE-352

Affected Products

spicethemes
newscrunch
≤ 1.8.4.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing WordPress theme enables exploitation of web app (T1190) and arbitrary file upload (T1105) via malicious link to admin (T1204.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References