CVE-2025-4946
Published: 02 July 2025
Summary
CVE-2025-4946 is a high-severity Path Traversal (CWE-22) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion in the vikinger_delete_activity_media_ajax() function due to insufficient file path validation. The flaw affects all versions through 1.9.32 when the Vikinger Media plugin is also installed and active, and it is tracked as CWE-22 with a CVSS 3.1 score of 8.1.
Authenticated attackers holding Subscriber or higher privileges can exploit the issue over the network to delete arbitrary files on the server. Successful deletion of critical files such as wp-config.php can readily result in remote code execution.
Public references point to the theme's ThemeForest page and a Wordfence vulnerability entry, but no specific patch or mitigation guidance is detailed in the available information. The associated EPSS score remains flat at 0.0563 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19695
Vulnerability details
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and…
more
above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.