Cyber Posture

CVE-2025-30996

Critical

Published: 06 January 2026

Published
06 January 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0019 40.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Newsy newsy allows Upload a Web Shell to a Web Server.This issue affects Themify Newsy: from n/a through <= 1.9.9.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Timely remediation of the flaw in Themify Newsy theme directly patches the unrestricted file upload vulnerability allowing web shells.

SI-10 Information Input Validation good match
prevent

Information input validation enforces checks on file types and contents during uploads, preventing dangerous web shells from being accepted.

SI-3 Malicious Code Protection good match
preventdetect

Malicious code protection at system entry points scans and eradicates web shells uploaded through the vulnerable Themify Newsy upload mechanism.

Security SummaryAI

CVE-2025-30996 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Themify Newsy WordPress theme. It enables the upload of a web shell to the web server. This issue affects Themify Newsy versions from n/a through 1.9.9.

The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating network accessibility, low attack complexity, requirement for low privileges, no user interaction, and changed scope with high impacts on confidentiality, integrity, and availability. An authenticated attacker with low privileges, such as a contributor role, can exploit it to upload and execute a web shell, potentially achieving full server compromise.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve provides details on this arbitrary file upload vulnerability in Themify Newsy 1.9.9. Security practitioners should review this reference for guidance on mitigation and available patches.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

The vulnerability is an exploitable flaw in public-facing WordPress themes (T1190) that directly enables uploading web shells for remote code execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References