EUVD-2025-209463
GHSA-8c4m-vfg9-p3hj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Same assessment as 3.1, attack requirements none, vulnerable system integrity high, no confidentiality/availability impact, no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory.
AnalysisAI
Arbitrary directory deletion in Eleganzo theme for WordPress up to version 1.2 allows authenticated attackers with Subscriber-level access to delete any server directory, including the WordPress root directory, via a path traversal flaw in the akd_required_plugin_callback function. No active exploitation or public proof-of-concept is known, and EPSS probability is very low.
Technical ContextAI
The vulnerability resides in a WordPress theme callback function (akd_required_plugin_callback) that fails to properly validate user-supplied file paths, leading to a path traversal (CWE-22) condition. The offending function likely processes plugin installation or requirement checks, and the reference to welcome.php#L96 suggests an exposed endpoint. The theme is identified by the vendor 'Eleganzo' with versions ≤1.2 (EUVD CPE: Eleganzo 0 ≤1.2). Root cause: insufficient sanitization allows directory separators (../) to escape the intended directory, granting high integrity impact but no confidentiality or availability loss.
RemediationAI
No vendor-released patch is available at time of analysis. Monitor the Wordfence advisory for updates (https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5d7818-e548-4d8f-b847-396d528b58cd?source=cve). Until a fix is released, consider temporarily disabling the Eleganzo theme or restrict Subscriber-level capabilities to mitigate exploitation. Removing write permissions on critical directories (e.g., the WordPress root) can limit impact but may break theme functionality. Review and harden any custom plugin-requirement logic that invokes the vulnerable callback.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today