CVE-2025-1305 is a CSRF vulnerability in the spicethemes NewsBlogger WordPress theme affecting all versions up to 0.2.5.4. The issue arises from missing or incorrect nonce validation in the newsblogger_install_and_activate_plugin() function, enabling attackers to perform unauthorized actions by tricking authenticated administrators into submitting malicious requests. Successful exploitation can lead to arbitrary file uploads and remote code execution. The vulnerability is remotely exploitable without privileges but requires user interaction (UI:R).

An attacker can exploit this vulnerability to upload arbitrary files and achieve remote code execution on affected WordPress sites using the NewsBlogger theme. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires tricking an administrator into performing an action, but no authentication is needed to initiate the attack. No known exploits have been reported in the wild so far.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin installation or activation actions. Consider disabling or removing the NewsBlogger theme if it is not essential to reduce exposure.