CVE-2025-10134

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575
https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=cve

Configurations

No configuration.

History

01 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) El tema de WordPress Goza - Nonprofit Charity WordPress Theme es vulnerable a la eliminación arbitraria de archivos debido a una validación insuficiente de la ruta de archivo en la función alone_import_pack_restore_data() en todas las versiones hasta la 3.2.2, inclusive. Esto hace posible que atacantes no autenticados eliminen archivos arbitrarios en el servidor, lo que puede conducir fácilmente a la ejecución remota de código cuando se elimina el archivo correcto (como wp-config.php).

Information

Published : 2025-09-09 09:15

Updated : 2026-10-01 16:10

NVD link : CVE-2025-10134

Mitre link : CVE-2025-10134

CVE.ORG link : CVE-2025-10134

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2025-10134", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10134", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-09T19:27:26.961665Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "Bearsthemes", "product": "Goza - Nonprofit Charity WordPress Theme", "versions": [{"status": "affected", "version": "3.2.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-09T09:15:34.897", "references": [{"url": "https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."}, {"lang": "es", "value": "El tema de WordPress Goza - Nonprofit Charity WordPress Theme es vulnerable a la eliminaci\u00f3n arbitraria de archivos debido a una validaci\u00f3n insuficiente de la ruta de archivo en la funci\u00f3n alone_import_pack_restore_data() en todas las versiones hasta la 3.2.2, inclusive. Esto hace posible que atacantes no autenticados eliminen archivos arbitrarios en el servidor, lo que puede conducir f\u00e1cilmente a la ejecuci\u00f3n remota de c\u00f3digo cuando se elimina el archivo correcto (como wp-config.php)."}], "lastModified": "2026-10-01T16:10:00.257", "sourceIdentifier": "security@wordfence.com"}