PT-2025-27590 · WordPress · The Home Villas | Real Estate Wordpress Theme

Thái An · Published 2025-07-02 · Updated 2025-07-07 · CVE-2025-5014

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Home Villas | Real Estate WordPress Theme versions up to, and including, 2.8

Description: The issue is related to insufficient file path validation in the wp rem cs widget file delete function, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution when specific files, such as wp-config.php, are deleted.

Recommendations: For versions up to, and including, 2.8, consider disabling the wp rem cs widget file delete function until a patch is available to prevent arbitrary file deletion. Restrict access to sensitive files on the server to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-5014

Affected Products

The Home Villas | Real Estate Wordpress Theme

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-5014 · Security Note
• https://twitter.com/CveFindCom/status/1940261763380851001 · Twitter Post
• https://twitter.com/cracbot/status/1942176821782667379 · Twitter Post
• https://twitter.com/SecAideInfo/status/1941078524271460494 · Twitter Post
• http://localhost:1337/wp-content/themes/homevillas-real-estate/include/backend/cs-widgets/import/cs-class-widget-data.php#L384 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afd4f2ca-9c27-4de0-ac82-3cd107b6a092?source=cve · Note