CVE-2025-1306 is a high-severity CSRF vulnerability in the Newscrunch WordPress theme by spicethemes affecting all versions up to 1.8.4. The issue arises from missing or incorrect nonce validation in the newscrunch_install_and_activate_plugin() function, enabling attackers to perform unauthorized actions by leveraging a site administrator's interaction with a crafted request. This can lead to arbitrary file uploads, compromising site security. The vulnerability is network exploitable without privileges but requires user interaction. No patch or official fix has been documented in the provided data.

Successful exploitation can lead to arbitrary file uploads by unauthenticated attackers, resulting in full compromise of confidentiality, integrity, and availability of the affected WordPress site. This could allow attackers to execute malicious code, deface the site, or disrupt service. The CVSS score of 8.8 reflects these severe impacts. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable Newscrunch theme. Implementing additional security controls such as Web Application Firewalls (WAF) that can detect and block CSRF attempts may provide temporary protection.