Critical severity · published Jan 6, 2026
CVE-2025-30996
Arbitrary File Upload Vulnerability in WordPress themes by Themify
9.9
CVSS
0.5%
EPSS
No
On KEV
Description
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Bloggie · Themify
through 2.0.8 · source: vendor
PH
Photobox · Themify
through 2.0.1 · source: vendor
RE
Rezo · Themify
through 1.9.7 · source: vendor
SL
Slide · Themify
through 1.7.5 · source: vendor
TE
Themify Edmin · Themify
through 2.0.0 · source: vendor
TF
Themify Folo · Themify
through 1.9.6 · source: vendor
TN
Themify Newsy · Themify
through 1.9.9 · source: vendor
TS
Themify Sidepane WordPress Theme · Themify
through 1.9.8 · source: vendor
WI
Wigi · Themify
through 2.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30996
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30996
patchstack.com
https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-arbitrary-file-upload-vulnerability?_s_id=cve
patchstack.com
https://patchstack.com/database/wordpress/theme/edmin/vulnerability/wordpress-themify-edmin-2-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
patchstack.com
https://patchstack.com/database/wordpress/theme/folo/vulnerability/wordpress-themify-folo-1-9-6-arbitrary-file-upload-vulnerability?_s_id=cve
patchstack.com
https://patchstack.com/database/wordpress/theme/newsy/vulnerability/wordpress-themify-newsy-1-9-9-arbitrary-file-upload-vulnerability?_s_id=cve
patchstack.com
https://patchstack.com/database/wordpress/theme/photobox/vulnerability/wordpress-photobox-2-0-1-arbitrary-file-upload-vulnerability?_s_id=cve
patchstack.com
https://patchstack.com/database/wordpress/theme/rezo/vulnerability/wordpress-rezo-1-9-7-arbitrary-file-upload-vulnerability?_s_id=cve