Wordpress Theme EUVD-2025-28281

This vulnerability represents CRITICAL real-world risk despite limited available exploitation data: (1) CVSS Score of 10.0 with AV:N/AC:L/PR:N/UI:N indicates maximum severity—network-accessible, no special conditions required, no privileges needed, no user interaction. (2) The vulnerability class (CWE-434) is among the most frequently exploited in real-world attacks; file upload flaws are commodity attack vectors. (3) The scope change (S:C) indicates privilege escalation or lateral movement potential. (4) Absence of version information ('n/a through n/a') suggests the vulnerability may affect all or most Flozen releases, widening impact. (5) EPSS score (if >0.97) would reflect high exploitation probability given the trivial attack complexity and complete lack of authentication. (6) KEV status unknown but this profile matches active exploitation patterns. (7) Proof-of-concept exploit development is straightforward for this vulnerability class. Organizations using Flozen should prioritize immediate patching; this is not a low-real-risk-high-CVSS scenario but rather a genuine critical threat.

An unauthenticated attacker identifies a website running vulnerable NasaTheme Flozen (e.g., via HTTP headers, CMS fingerprinting). The attacker navigates to the file upload endpoint (commonly /wp-content/themes/flozen/upload.php or similar) and crafts a multipart HTTP POST request containing a PHP web shell (e.g., a reverse shell or simple command executor: <?php system($_GET['cmd']); ?>) with a filename like 'shell.php' or obfuscated as 'image.php.jpg'. Due to insufficient server-side validation, the file is accepted and stored in a web-accessible directory. The attacker then directly accesses the uploaded shell via HTTP (e.g., http://target.com/uploads/shell.php?cmd=id), causing the web server to execute the PHP code. The attacker now has arbitrary code execution as the web server user (often 'www-data'), enabling data exfiltration, malware installation, lateral network movement, or complete site compromise. No POC availability status confirmed, but exploitation is trivial given the vulnerability class.