Executive brief
The NewsBlogger WordPress theme contains a vulnerability in its plugin installation function that bypasses security checks. An attacker can trick a site administrator into clicking a malicious link to upload arbitrary files and take over the website with administrator-level access, bypassing normal permission controls and potentially exposing customer data or disrupting site operations.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the newsblogger_install_and_activate_plugin() function due to missing or incorrect nonce validation. The affected versions (0.2.5.6 to 0.2.5.9) are susceptible to unauthenticated attackers who can forge requests to upload arbitrary files. The attack requires social engineering—tricking an administrator into clicking a link—but results in remote code execution with the privileges of the site administrator. This is a regression (reversion of CVE-2025-1305), and patches are available in version 0.2.6 and later.
Affected products
- WordPress NewsBlogger theme 0.2.5.6 to 0.2.5.9
Timeline
- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in version 0.2.6