CVE-2025-62050
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| blazethemes | blogmatic | From 1.0.0 (inc) to 1.0.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62050 is a high-priority Arbitrary File Upload vulnerability in the WordPress Blogmatic Theme versions 1.0.3 and earlier. It allows an attacker with subscriber or developer privileges to upload arbitrary files, including malicious backdoors, to the affected website. This vulnerability falls under OWASP Top 10 A3: Injection and can lead to unauthorized code execution and further compromise of the site. [1]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to unauthorized code execution on the affected website, allowing attackers to install malicious backdoors and potentially take full control of the site. This can result in data breaches, site defacement, loss of service, and further compromise of the hosting environment. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for the presence of arbitrary or suspicious file uploads in the Blogmatic theme directories, especially files uploaded by users with subscriber or developer privileges. Monitoring web server logs for unusual POST requests to upload endpoints or scanning for newly added files with dangerous extensions may help. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step is to update the Blogmatic theme to version 1.0.4 or later, which resolves the vulnerability. Until updating, applying Patchstack's mitigation rules to block attacks targeting this vulnerability is recommended. Using automated vulnerability mitigation and continuous security intelligence tools from Patchstack can also help protect the site. [1]