CVE-2025-50002

Critical

Published: 22 January 2026

Published

22 January 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0051 39.3th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-50002 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-50002 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Farost Energia WordPress theme, known as Energia. This issue affects versions from n/a through 1.1.2 and allows attackers to upload a web shell to the web server. Published on 2026-01-22, it carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction. By uploading a dangerous file such as a web shell, they achieve high-impact compromise across confidentiality, integrity, availability, and scope change, potentially leading to full server control.

The Patchstack advisory documents this as an arbitrary file upload vulnerability in the WordPress Energia theme version 1.1.2.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-4115

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through <= 1.1.2.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Arbitrary file upload (CWE-434) in public-facing WordPress theme directly enables remote web shell deployment (T1100) via exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0