CVE-2025-68909CWE-434

WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability

Critical · published January 22, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability in Blogistic could let anyone inject malicious files straight into your website! 🔥 Imagine a restaurant where anyone can drop off any dish without the chef checking the ingredients — you could end up with something truly toxic on the menu! 🍽️ This vulnerability could allow an attacker to upload harmful scripts or files, leading to unauthorized access, data breaches, or even complete site takeover. It’s a recipe for disaster that could compromise user data and tarnish your online reputation!

Put simply

Imagine a restaurant where anyone can drop off any dish without the chef checking the ingredients — you could end up with something truly toxic on the menu! 🍽️ The flaw in Blogistic allows attackers to upload files of any type without proper validation, meaning malicious files can be executed on the server, potentially leading to severe security breaches.

What to do

This vulnerability could allow an attacker to upload harmful scripts or files, leading to unauthorized access, data breaches, or even complete site takeover. It’s a recipe for disaster that could compromise user data and tarnish your online reputation! Patch Blogistic immediately by upgrading to version 1.0.6 or later. Additionally, implement strict file type validations on your upload functionality to prevent any unauthorized file types from being accepted. It's essential to keep your software up to date! You've got this! By taking these steps, you’ll be fortifying your defenses and securing your site in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00576 · 46.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability
    cvelistv5