CVE-2025-1307

CVE-2025-1307 is a critical arbitrary file upload vulnerability affecting all versions up to and including 1.8.4.1 of the Newscrunch WordPress theme. This flaw, stemming from a missing capability check, allows authenticated attackers with Subscriber-level access or higher to upload malicious files, potentially leading to remote code execution. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high EPSS and FAUCET Risk Score indicate a significant potential for future exploitation.