Platform
wordpress
Component
flozen-theme
Fixed in
1.5.2
CVE-2025-49071 describes an Arbitrary File Access vulnerability within the NasaTheme Flozen flozen-theme component. This flaw allows attackers to upload files of any type, including malicious web shells, to a web server. Versions of Flozen between 0.0.0 and 1.5.1 are affected. A fix is available in version 1.5.1.
The primary impact of CVE-2025-49071 is the ability for an attacker to upload arbitrary files to the web server. This includes web shells, which provide a remote command execution interface. Successful exploitation grants the attacker complete control over the affected server, enabling data theft, modification, and further lateral movement within the network. The blast radius extends to any sensitive data stored on the server or accessible through it. This vulnerability shares similarities with other file upload vulnerabilities where attackers leverage the ability to execute code on the server.
CVE-2025-49071 has a CRITICAL CVSS score of 10, indicating a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge given the ease of exploitation. While no active campaigns have been publicly reported as of the publication date (2025-06-17), the vulnerability's severity warrants immediate attention. This vulnerability is not currently listed on KEV or EPSS, but its critical nature suggests a potential for future inclusion.
Exploit Status
EPSS
0.13% (32% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-49071 is to immediately upgrade Flozen to version 1.5.1 or later. If upgrading is not immediately feasible, implement strict file upload validation on the server-side to prevent the upload of executable files. Configure a Web Application Firewall (WAF) to block suspicious file uploads and detect attempts to execute uploaded files. Regularly scan the server for unauthorized files and monitor web server logs for unusual activity. After upgrading, confirm the vulnerability is resolved by attempting to upload a test file with a known dangerous extension (e.g., .php) and verifying that the upload is rejected.
Actualice el tema Flozen a una versión superior a 1.5.1 para mitigar la vulnerabilidad de carga de archivos arbitrarios. Verifique que las actualizaciones de seguridad del tema se apliquen regularmente para evitar futuros problemas. Considere implementar medidas de seguridad adicionales, como restringir los tipos de archivos que se pueden cargar.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-49071 is a critical vulnerability in Flozen allowing attackers to upload arbitrary files, including web shells, potentially leading to full server compromise. It affects versions 0.0.0–1.5.1 and requires immediate attention.
If you are using Flozen versions 0.0.0 through 1.5.1, you are potentially affected. Verify your Flozen version and upgrade immediately if vulnerable.
Upgrade Flozen to version 1.5.1 or later. If immediate upgrade is not possible, implement strict file upload validation and WAF rules as temporary mitigations.
While no active campaigns have been publicly reported, the vulnerability's critical nature suggests a high likelihood of exploitation. Monitor your systems closely.
Refer to the NasaTheme Flozen project's official website or GitHub repository for the latest advisory and security updates related to CVE-2025-49071.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.