CVE-2025-1304 is a missing authorization vulnerability (CWE-862) in the NewsBlogger WordPress theme by spicethemes. The issue arises from the absence of capability checks in the newsblogger_install_and_activate_plugin() function, allowing authenticated users with minimal privileges (subscriber and above) to upload arbitrary files. This can lead to remote code execution on the affected server. The vulnerability affects all versions up to and including 0.2.5.1. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link available at this time.

An attacker with subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable NewsBlogger theme, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and consider disabling or removing the NewsBlogger theme if possible to reduce risk.