Critical · published March 4, 2025
🔥 Subscribers can now play the role of a rogue admin, thanks to a missing capability check in the Newscrunch theme for WordPress! Picture a library without a proper check-out system, where anyone with a library card can bring in their own books and replace them with whatever they want, even the questionable ones. That's what this vulnerability allows: authenticated users can upload arbitrary files, potentially compromising the entire system! An attacker with Subscriber-level access could exploit this vulnerability to upload malicious files, leading to remote code execution. This means they could potentially take full control of your website, reading sensitive data, manipulating content, or even locking you out. It's a gateway to absolute chaos!
Picture a library without a proper check-out system, where anyone with a library card can bring in their own books and replace them with whatever they want, even the questionable ones. That's what this vulnerability allows: authenticated users can upload arbitrary files, potentially compromising the entire system! The Newscrunch theme's function, `newscrunch_install_and_activate_plugin()`, lacks a crucial capability check, allowing authenticated users to upload any file onto the server, which could lead to devastating consequences.
An attacker with Subscriber-level access could exploit this vulnerability to upload malicious files, leading to remote code execution. This means they could potentially take full control of your website, reading sensitive data, manipulating content, or even locking you out. It's a gateway to absolute chaos! Update the Newscrunch theme to the latest version immediately, as versions up to and including 1.8.4.1 are affected. Consider reviewing user roles and permissions to restrict file uploads. Implement additional security measures, such as file type validation, to further protect your site. You’ve got this! Following these steps will help you secure your website and keep those rogue uploads at bay! 🛡️