Skip to main content

Wordpress Theme EUVDEUVD-2025-19974

| CVE-2025-30933 CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2025-07-04 audit@patchstack.com
WordPress File Upload Wordpress Theme
10.0
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-434
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK

2 techniques across 2 tactics: Command and Control, Persistence

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 26, 2026

Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, including web shells, enabling full server compromise. Affected versions range from n/a through 1.1.6. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS base score of 10.0, though the EPSS exploitation probability is low (0.07%); no active exploitation or public proof-of-concept has been confirmed at the time of analysis.

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 02:42 CVSS 10.0

Affected VersionsENISA

LogisticsHub n/a ≤1.1.6

Affected Packages

euvd logisticshub no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Wordpress Theme gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub allows Upload a Web Shell to a Web Server. This issue affects LogisticsHub: from n/a through 1.1.6.

Executive ViewAI

Why It Matters

CVE-2025-30933 presents critical security risk, a unrestricted file upload vulnerability rated CVSS 10.0. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Recommended Action

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Review file handling controls and restrict upload directories.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +50
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Malicious File Upload HIGH

Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.

More in Wordpress Theme

View all
CVE-2025-1307 CRITICAL
9.8 Mar 04

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
CVE-2019-25142 HIGH POC
8.8 Jun 07

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
CVE-2023-45657 HIGH
8.5 Nov 06

A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
CVE-2020-36721 MEDIUM POC
6.5 Jun 07

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
CVE-2024-52413 CRITICAL
9.8 Nov 16

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
CVE-2025-48106 CRITICAL
10.0 Oct 22

Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to

CVE-2020-17362 MEDIUM POC
6.1 Aug 12

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
CVE-2025-49060 CRITICAL
10.0 Oct 22

Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
CVE-2026-39770 CRITICAL
10.0 Oct 06

Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
CVE-2025-26927 CRITICAL
10.0 Apr 15

Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
CVE-2026-81779 CRITICAL
10.0 Aug 31

Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
CVE-2025-49071 CRITICAL
10.0 Jun 17

Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2025-52691 CRITICAL POC
10.0
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2020-1938 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-30933 REF https://patchstack.com/database/Wordpress/Theme/logistics-hub/vulnerability/wordpress-logisticshub-1-1-6-arbitrary-file-upload-vulnerability?_s_id=cve REF https://patchstack.com/database/wordpress/theme/logistics-hub/vulnerability/wordpress-logisticshub-1-1-6-arbitrary-file-upload-vulnerability?_s_id=cve

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy