PT-2025-27620 · WordPress · Vikinger Media+1

Friderika Baranyai · Published 2025-07-02 · Updated 2025-07-04 · CVE-2025-4946

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Vikinger theme for WordPress versions up to, and including, 1.9.32

Description: The issue is related to insufficient file path validation in the vikinger delete activity media ajax() function. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server, potentially leading to remote code execution when critical files, such as wp-config.php, are deleted. The exploitation of this issue requires the Vikinger Media plugin to be installed and active.

Recommendations: For versions up to, and including, 1.9.32, update to a version higher than 1.9.32 to resolve the issue. As a temporary workaround, consider disabling the vikinger delete activity media ajax() function until a patch is available. Restrict access to the Vikinger Media plugin to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-4946

Affected Products

Vikinger

Vikinger Media

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4946 · Security Note
• https://twitter.com/SecAideInfo/status/1941078533578555605 · Twitter Post
• https://t.me/cvenotify/127369 · Telegram Post
• https://twitter.com/CVEnew/status/1940345965669466476 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/22d8f1db-1b7e-4b68-a381-01f51dd34b2b?source=cve · Note
• https://themeforest.net/item/vikinger-buddypress-and-gamipress-social-community/28612259 · Note