Newsup Theme CVE-2025-8682
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Newsup theme
-
ExploitSend request to unprotected install handler
-
ExecutionBypass missing capability check
-
ImpactInstall ansar-import plugin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Newsup WordPress theme (versions up to and including 5.0.10) to be installed and active; the vulnerable newsup_admin_info_install_plugin() function performs no capability check, so per the description an unauthenticated request can invoke it. Exploitation is functionally limited to installing one specific plugin (ansar-import) rather than arbitrary code or data access, which caps direct impact (I:L, no C/A impact). Note the data conflict: the NVD vector lists PR:L despite the 'unauthenticated' description - if authentication is in fact required, that would further limit real-world exploitation. |
| Impact | This is a moderate, not high-priority, issue. CVSS is only 4.3 and the EPSS score is very low (0.25%, 15th percentile), indicating little predicted real-world exploitation. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' A key CONFLICT exists: the NVD CVSS vector specifies PR:L (authenticated, low privilege) and yields 4.3, but the description explicitly states 'unauthenticated attackers' and the root cause is a missing capability check (CWE-862) - verify authentication requirement with vendor/Wordfence, as PR:L appears to understate the flaw. The impact is also narrow by design: the bug only permits installation of one specific plugin (ansar-import), scored I:L with C:N/A:N, so direct damage is limited unless that plugin or the resulting state enables further compromise. No SSVC decision data was provided. Net: a genuine access-control defect worth patching on affected sites, but not an urgent, widely-weaponized threat based on current signals. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running the Newsup theme (≤5.0.10) and, per the description without needing authentication, sends a request invoking the unprotected newsup_admin_info_install_plugin() handler. This triggers installation of the ansar-import plugin on the victim site, expanding the installed attack surface. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthorized plugin installation in the Newsup WordPress theme through version 5.0.10 lets an attacker invoke newsup_admin_info_install_plugin(), which lacks a capability check (CWE-862), to install the ansar-import plugin. Our independent assessment treats this as unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while NVD's vector lists PR:L, creating an authentication-requirement conflict. Impact is limited to integrity with no confidentiality or availability loss; EPSS is 0.25% (15th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis. An upstream Trac changeset appears to address the missing check.
RemediationAI
Update the Newsup theme to a release newer than 5.0.10 once the vendor publishes it; the supplied WordPress Trac changeset 292407 appears to contain the upstream fix, but no exact patched version number is provided in the data, so patch status is Upstream fix available (changeset); released patched version not independently confirmed. If the theme cannot be updated immediately, consider deactivating or removing it if it is not business-critical. If it must remain active, deploy a WAF rule blocking unauthenticated requests to admin-ajax.php or admin-post.php actions that invoke newsup_admin_info_install_plugin(), and monitor for unexpected ansar-import plugin installation; note WAF bypass risks via direct calls or parameter variation. Enforcing DISALLOW_FILE_MODS in wp-config.php prevents plugin and theme installation entirely but also blocks legitimate updates and may disrupt site management. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40ce-b500-317150a2da3b?source=cve) and CleanTalk research (https://research.cleantalk.org/cve-2025-8682) for updates.
Affected ProductsAI
Newsup WordPress theme, all versions up to and including 5.0.10. No CPE strings were included in the supplied data. The vulnerable component is the theme's newsup_admin_info_install_plugin() function, which can install the ansar-import plugin. Vendor and advisory references include the WordPress Trac changeset at https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=292407%40newsup&new=292407%40newsup&sfp_email=&sfph_mail= and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40ce-b500-317150a2da3b?source=cve, plus CleanTalk research at https://research.cleantalk.org/cve-2025-8682.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Newsup theme for WordPress defines newsup_admin_info_install_plugin(), a function intended to install the ansar-import plugin from an administrative interface. The root cause is CWE-862 Missing Authorization: the function does not perform a current_user_can('install_plugins') style capability check before acting, so a request can trigger plugin installation without proper authorization. The NVD CVSS vector uses PR:L, while our assessment uses PR:N based on the unauthenticated description and the missing capability check; if authentication is in fact required, exploitability is lower. The supplied data does not include CPE strings, but the affected component is specifically the Newsup WordPress theme, not WordPress core. WordPress plugin and theme installation normally requires install_plugins capability and nonce protections; the absent check is the core defect. EPSS 0.25% and no KEV indicate low observed exploitation.
Know when Wordpress Theme gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description states unauthenticated attackers and CWE-862 missing capability check, so PR:N/AC:L/UI:N; impact limited to installing one plugin, so I:L with C:N/A:N.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Theme
View allThe Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
GitHub PoC
Exploit-DB