This vulnerability (CVE-2025-30996) involves an unrestricted file upload flaw (CWE-434) present in multiple Themify WordPress themes, including Sidepane, Newsy, Folo, Edmin, Bloggie, Photobox, Wigi, Rezo, and Slide. The flaw allows attackers with low privileges to upload files of dangerous types, such as web shells, to the web server. This can lead to complete compromise of the affected system. The vulnerability affects all versions up to 1.9.8 for Sidepane, 1.9.9 for Newsy, 1.9.6 for Folo, 2.0.0 for Edmin, 2.0.8 for Bloggie, 2.0.1 for Photobox and Wigi, 1.9.7 for Rezo, and 1.7.5 for Slide. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and no known exploits have been reported.

Successful exploitation allows an attacker with low privileges to upload malicious files, such as web shells, to the web server hosting the affected WordPress themes. This can lead to full system compromise, including unauthorized access, data theft, data modification, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions and monitor for suspicious file uploads. Avoid using affected versions of the Themify themes if possible. Follow vendor updates closely for any forthcoming patches or official mitigations.