CVE-2025-8682

The Newsup WordPress theme (up to version 5.0.10) contains a missing authorization vulnerability in the newsup_admin_info_install_plugin() function. This function is exposed via an AJAX action install_act_plugin and lacks a proper capability check, allowing unauthorized actions [1].

An attacker can exploit this by sending a request to admin-ajax.php with the action parameter install_act_plugin. The handler does not verify user capabilities (e.g., install_plugins or manage_options) and is callable without a CSRF nonce, enabling unauthenticated attackers or low-privileged users (Subscriber+) to trigger plugin installation and activation flows [1].

Successful exploitation allows an attacker to install the ansar-import plugin or any arbitrary plugin without authorization, potentially introducing malicious code and compromising the site's security [1]. The vulnerability has been publicly disclosed, a proof-of-concept exists, but no active exploits have been reported yet. Users are advised to update the theme to the latest version and ensure proper security measures are in place [1].