The vulnerability CVE-2025-62056 affects the blazethemes News Event plugin up to version 1.0.1. It permits unrestricted upload of files with dangerous types, meaning the plugin does not properly restrict or validate file types during upload. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data, and it is not a cloud service. There are no known exploits in the wild as of the published date.

Successful exploitation allows an attacker with low privileges to upload malicious files, which can lead to complete compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, data modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious uploads. Avoid using affected versions of the News Event plugin if possible.