{"id":"CVE-2025-8682","title":"The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10","summary":"The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10. This makes it possible fo…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-862"],"published":"2025-10-11","updated":"2026-10-08","sourceUpdated":"2026-10-08T13:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-8682","references":[{"url":"https://research.cleantalk.org/cve-2025-8682","label":"security@wordfence.com"},{"url":"https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=292407%40newsup&new=292407%40newsup&sfp_email=&sfph_mail=","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40ce-b500-317150a2da3b?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"epss":0.00249,"epssPercentile":0.14867,"ingestedAt":"2026-10-08T13:42:55.108Z","slug":"CVE-2025-8682","body":"## Overview\n\nThe Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}