Cyber Posture

CVE-2025-50002

Critical

Published: 22 January 2026

Published
22 January 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0006 19.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50002 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of file uploads to block dangerous types like web shells, addressing the core unrestricted upload vulnerability.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific flaw in the Energia theme that permits unrestricted file uploads.

SI-3 Malicious Code Protection good match
preventdetect

Scans uploaded files for malicious code such as web shells at network entry points or endpoints, preventing execution post-upload.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1100 Web Shell Persistence
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.
attack.mitre.org →
Why these techniques?

Arbitrary file upload (CWE-434) in public-facing WordPress theme directly enables remote web shell deployment (T1100) via exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through <= 1.1.2.

Deeper analysisAI

CVE-2025-50002 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Farost Energia WordPress theme, known as Energia. This issue affects versions from n/a through 1.1.2 and allows attackers to upload a web shell to the web server. Published on 2026-01-22, it carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction. By uploading a dangerous file such as a web shell, they achieve high-impact compromise across confidentiality, integrity, availability, and scope change, potentially leading to full server control.

The Patchstack advisory documents this as an arbitrary file upload vulnerability in the WordPress Energia theme version 1.1.2.

Details

CWE(s)
CWE-434

CVEs Like This One

CVE-2025-49387Shared CWE-434
CVE-2025-52353Shared CWE-434
CVE-2025-25790Shared CWE-434
CVE-2025-22504Shared CWE-434
CVE-2026-33717Shared CWE-434
CVE-2025-14894Shared CWE-434
CVE-2025-65783Shared CWE-434
CVE-2025-44658Shared CWE-434
CVE-2026-37748Shared CWE-434
CVE-2026-1222Shared CWE-434

References