CVE-2025-1307 is a missing authorization vulnerability (CWE-862) in the Newscrunch WordPress theme by spicethemes. The issue exists in the newscrunch_install_and_activate_plugin() function, which lacks proper capability checks, allowing authenticated users with minimal privileges (Subscriber level and above) to upload arbitrary files to the server. This can lead to remote code execution if malicious files are uploaded and executed. The vulnerability affects all versions up to and including 1.8.4.1. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can upload arbitrary files to the affected server, potentially enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is critical due to the ease of exploitation and the high impact on the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, and monitor for suspicious file uploads. Consider disabling or removing the Newscrunch theme if possible to reduce exposure.