What the vulnerability does
01Description
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
NewsBlogger versions up to 0.2.5.4 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted operations without their knowledge. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site by tricking an admin into visiting a malicious link.
Potential impact on your site
04Site Impact
Attackers can modify site content, change settings, or compromise user data if an admin is tricked into visiting a malicious page.
Conditions required to exploit
05Prerequisites
An administrator must visit a malicious page or click a crafted link while logged in.
Key dates
06Disclosure timeline
May 1, 2025
CVE published
April 8, 2026
Record updated
