CVE-2025-50002CWE-434

WordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability

Critical · published January 22, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

🚨 Unrestricted file upload? Absolutely devastating! This vulnerability in Farost Energia lets attackers drop a sneaky web shell right onto your server! 🔥 Think of it like ordering a pizza, and instead of just pepperoni and cheese, the delivery person hands you a box full of surprise toppings, including some that could spoil the whole meal. An unrestricted file upload allows anyone to deliver potentially harmful files straight into your kitchen — aka your web server! If exploited, an attacker could gain full control over your server, accessing sensitive data, modifying content, or even bringing your site down. It's not just a little mess; it's a full-blown crisis that could compromise your entire infrastructure. You could be left scrambling to regain control and restore services!

Put simply

Think of it like ordering a pizza, and instead of just pepperoni and cheese, the delivery person hands you a box full of surprise toppings, including some that could spoil the whole meal. An unrestricted file upload allows anyone to deliver potentially harmful files straight into your kitchen — aka your web server! This vulnerability allows unauthorized users to upload dangerous file types, including web shells, to the server without any checks. The affected versions include Energia up to 1.1.2, allowing attackers to execute harmful scripts remotely without authentication.

What to do

If exploited, an attacker could gain full control over your server, accessing sensitive data, modifying content, or even bringing your site down. It's not just a little mess; it's a full-blown crisis that could compromise your entire infrastructure. You could be left scrambling to regain control and restore services! Immediately update Energia to version 1.1.3 or later to close this critical vulnerability. Additionally, implement strict file type restrictions and validation checks on any file uploads to prevent unauthorized access. Don't leave any room for surprises! You've got this! Follow these steps, and you'll have your server back in tip-top shape! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00627 · 49.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability
    cvelistv5