CVE-2025-49071

CVE-2025-49071 Flozen 1.5.1 - 未认证的任意文件上传 描述： Flozen Theme 1.5.1 - 未认证的任意文件上传 描述 WordPress 的 Flozen 主题（版本 1.5.1 及以下）存在未认证的任意文件上传漏洞，原因是 flozenaddnewcustomfont 函数缺少身份验证检查且文件类型验证不足。这允许未认证的攻击者上传包含恶意 PHP 代码（例如 webshell）的任意 ZIP 文件，这些文件会自动解压到 wp-content/uploads/nasa-custom-fonts/ 目录，从而导致完全远程代码执行（RCE）。 信息...

Exploit for CVE-2025-49071

CVE-2025-49071 Flozen 1.5.1 - Unauthenticated Arbitrary File...

WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Flozen versions 1.5.1...

WordPress Flozen Theme < 1.5.1 is vulnerable to Arbitrary File Upload

Software Flozen Type Theme Vulnerable versions 1.5.1 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-49071 Patch priority High CVSS severity High 10 Developer Claim ownership PSID b0bba867fa7b Credits Phat RiO - BlueRock Required privilege Unauthenticat...