← CVE Tracker
9.1CRITICAL

CVE-2025-10134 — The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion…

Unknown · Unknown · Published 9 Sept 2025 · Modified 1 Oct 2026

Description

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

References

What to do
  1. Check whether Unknown is in your asset inventory.
  2. Patch in the next maintenance window; prioritise internet-facing systems.
  3. Record the decision in your risk register for audit evidence.
Alert me on similar CVEs →
Share

Link: adminadda.com/cve/CVE-2025-10134