CVE-2025-30996: WordPress Themify Newsy <= 1.9.9 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Newsy newsy allows Upload a Web Shell to a Web Server.This issue affects Themify Newsy: from n/a through <= 1.9.9.
Other sources
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30996?
CVE-2025-30996 is classified as a high severity vulnerability due to the potential for unrestricted file uploads leading to web shell deployment.
How do I fix CVE-2025-30996?
To fix CVE-2025-30996, update to the latest version of the affected Themify themes beyond the vulnerable versions listed.
Which versions of Themify themes are affected by CVE-2025-30996?
CVE-2025-30996 affects Themify Sidepane up to version 1.9.8, Themify Newsy up to version 1.9.9, and several other Themify themes within specific version ranges.
What types of files can be uploaded due to CVE-2025-30996?
CVE-2025-30996 allows for the upload of potentially dangerous file types, including web shells, which can compromise the security of a website.
Can CVE-2025-30996 be exploited without authentication?
Yes, CVE-2025-30996 can be exploited by unauthenticated users, making it particularly dangerous for affected sites.