External risk intelligence

StylemixThemes Motors Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-64374

This vulnerability exists in a WordPress theme, which is typically deployed as part of public-facing web applications. Because WordPress themes are designed to render web content to internet users, they are commonly exposed to the public internet by default.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability, affecting the Motors theme, could allow unauthorized users to upload malicious files, potentially leading to a compromise of the system. While the specific impact depends on how the theme is used and configured, it highlights a potential risk for organizations relying on this technology. The primary concern is to confirm if this theme is in use and, if so, assess the exposure.

Malicious file uploads are possible.
Understand if this theme is in use.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access could upload a specially crafted file to the affected website. This malicious file could then be used to compromise the website's backend, potentially leading to the execution of arbitrary code.

Authenticated access required.
Uploading a malicious file.
High impact on confidentiality, integrity, and availability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to upload and execute malicious files through the StylemixThemes Motors theme. When supported by the advisory, this could impact the availability and integrity of the affected system by enabling unauthorized code execution.

Malicious files could be uploaded.
Uploads may occur over the network.
System integrity and availability could be affected.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Motors theme requires action from the team responsible for managing WordPress plugins and themes, likely the website owner or a designated web administrator, potentially coordinating with a vendor management team if the site is managed by a third party. The immediate first step is to identify all instances of the affected theme, confirm their exposure and business criticality, and then plan remediation based on that assessment.

Website owner or administrator owns the issue.
Verify theme installations and exposure.
Plan vendor-coordinated update or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the StylemixThemes Motors theme?

Motors is a dedicated WordPress theme designed for automotive businesses, such as car dealerships and classified listing sites. It provides the layout, styling, and specific features needed to manage vehicle inventories, search filters, and user interactions on a website. Because it runs on the WordPress platform, it relies on the underlying server to host content, manage user accounts, and process file uploads that keep the site functional for both visitors and administrators.

What does CWE-434 mean for CVE-2025-64374?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the software fails to properly check or limit the types of files users can upload to the server. Because the application does not verify the file extension or content, an attacker can upload a script or malicious file instead of an expected format like an image. Once uploaded, the server may mistakenly treat this file as a trusted part of the application, allowing for unauthorized code execution.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by submitting a malicious file through the upload functionality provided by the Motors theme. Crucially, this attack path requires the attacker to have some level of authenticated access to the system; it cannot be triggered by an unauthenticated visitor simply browsing the site. If the theme's upload process is not being used by the attacker, or if the user lacks the necessary credentials to reach the upload interface, the specific weakness remains unreachable.

Is my website at risk if I use Motors?

Halo Surface Signal notes that WordPress themes like Motors are designed to render content to the public, making them inherently internet-facing by default. If your site is accessible from the public internet, the potential for interaction is higher. You should care about this vulnerability if your organization hosts a web application using this theme, as the flaw allows for significant impact on the confidentiality, integrity, and availability of the system if successfully exploited.

What are the first steps to address this issue?

The priority is to inventory your web assets to confirm whether the StylemixThemes Motors theme is currently installed and active. Do not assume all installations are known; check with your web administration or development teams. Once identified, evaluate the business criticality of the affected sites and the exposure level. While planning for a vendor-supplied update or patch is the goal, immediate mitigation may involve restricting upload access or disabling the affected feature entirely.

References

patchstack.com/database/Wordpress/Theme/motors/vulnerability/wordpre…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.