CVE-2025-30996

Critical

Published: 06 January 2026

Published

06 January 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0044 34.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-30996 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-30996 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Themify Newsy WordPress theme. It enables the upload of a web shell to the web server. This issue affects Themify Newsy versions from n/a through 1.9.9.

The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating network accessibility, low attack complexity, requirement for low privileges, no user interaction, and changed scope with high impacts on confidentiality, integrity, and availability. An authenticated attacker with low privileges, such as a contributor role, can exploit it to upload and execute a web shell, potentially achieving full server compromise.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve provides details on this arbitrary file upload vulnerability in Themify Newsy 1.9.9. Security practitioners should review this reference for guidance on mitigation and available patches.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-0951

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Newsy newsy allows Upload a Web Shell to a Web Server.This issue affects Themify Newsy: from n/a through <= 1.9.9.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability is an exploitable flaw in public-facing WordPress themes (T1190) that directly enables uploading web shells for remote code execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0