CVE-2025-30996: 
WordPress vulnerability analysis and mitigation

CVE-2025-30996 is an Unrestricted File Upload vulnerability (CWE-434) affecting nine Themify WordPress themes that allows authenticated attackers to upload web shells to the web server. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on March 19–20, 2025, and publicly disclosed by Patchstack on January 6, 2026. Affected themes and their vulnerable versions include: Themify Sidepane (≤ 1.9.8), Themify Newsy (≤ 1.9.9), Themify Folo (≤ 1.9.6), Themify Edmin (≤ 2.0.0), Bloggie (≤ 2.0.8), Photobox (≤ 2.0.1), Wigi (≤ 2.0.1), Rezo (≤ 1.9.7), and Slide (≤ 1.7.5). It carries a CVSS v3.1 base score of 9.9 (Critical), assigned by Patchstack (Patchstack Bloggie, Patchstack Newsy).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the affected themes fail to properly validate or restrict the file types that authenticated users can upload. An attacker with Contributor or Developer-level WordPress privileges can exploit this by uploading a PHP web shell or other executable file through the theme's file upload functionality, bypassing any file type restrictions. Once uploaded, the malicious file can be accessed via the web server to execute arbitrary server-side code. No specific technical write-up or proof-of-concept code has been publicly released as of the time of this report (Patchstack Folo, Patchstack Edmin).

Successful exploitation allows an authenticated attacker to achieve remote code execution on the web server, resulting in high impact to confidentiality, integrity, and availability. An attacker can gain full control of the WordPress installation, access sensitive data (including credentials and user information), deface or modify website content, and potentially pivot to other systems on the hosting network. The changed scope in the CVSS vector indicates that the impact extends beyond the vulnerable WordPress theme itself to the underlying server environment (Patchstack Bloggie, Patchstack Newsy).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.111%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, and has issued a virtual patch/mitigation rule for subscribers (Patchstack Bloggie, Feedly).

1. Reconnaissance: Identify WordPress sites using one of the nine affected Themify themes (Sidepane, Newsy, Folo, Edmin, Bloggie, Photobox, Wigi, Rezo, Slide) via tools like WPScan, Shodan, or by inspecting page source for theme identifiers.
2. Obtain low-privilege access: Register or compromise a WordPress account with at least Contributor or Developer privileges on the target site.
3. Locate the upload endpoint: Navigate to the theme's file upload functionality (e.g., theme customizer, media upload, or a theme-specific upload feature) that lacks proper file type validation.
4. Craft malicious payload: Prepare a PHP web shell (e.g., <?php system($_GET['cmd']); ?>) saved with a .php extension.
5. Upload the web shell: Submit the malicious file through the vulnerable upload endpoint; the theme fails to restrict the file type and saves it to a web-accessible directory.
6. Execute arbitrary commands: Access the uploaded web shell via its URL (e.g., https://target.com/wp-content/themes/<theme>/uploads/shell.php?cmd=id) to execute arbitrary OS commands and achieve full server compromise (Patchstack Bloggie, Patchstack Edmin).

• File System: Unexpected .php files in theme directories (e.g., /wp-content/themes/bloggie/, /wp-content/themes/newsy/, or similar Themify theme folders); web shell files with names like shell.php, cmd.php, or random alphanumeric filenames with .php extensions.
• Network: Unusual HTTP GET or POST requests to PHP files within theme directories containing parameters such as cmd, exec, c, or command; outbound connections from the web server process to unknown external IPs.
• Logs: WordPress access logs showing file upload requests to theme-specific endpoints followed by direct HTTP requests to newly created PHP files in theme directories; error logs showing PHP execution from unexpected paths.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx) such as bash, sh, curl, wget, or python; unexpected cron jobs or scheduled tasks created under the web server user account (Patchstack Bloggie).

As of the time of this report, no official patches have been released by Themify for any of the affected themes. Patchstack has issued virtual mitigation rules for subscribers to block exploitation attempts until official patches are available. Recommended actions include: (1) immediately audit all WordPress installations for use of the affected themes; (2) remove or deactivate unused Themify themes; (3) restrict file upload permissions and implement strict server-side file type validation via WAF rules; (4) limit WordPress user roles and avoid granting Contributor or higher privileges to untrusted users; (5) monitor file system changes in theme directories for unexpected PHP files; and (6) apply Patchstack's virtual patch as an interim measure (Patchstack Bloggie, Patchstack Newsy).

The vulnerability was discovered and reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and disclosed through Patchstack's coordinated vulnerability disclosure process. Patchstack has flagged this class of vulnerability as commonly leveraged in mass-exploit campaigns against WordPress sites. The CVE received coverage in security aggregators and community feeds shortly after disclosure, including mentions on Mastodon and Bluesky CVE tracking accounts, as well as inclusion in Qualys application security detection updates for March 2026 (Patchstack Bloggie, Feedly).