PT-2025-38501 · WordPress · Goza - Nonprofit Charity Wordpress Theme

Grov X · Published 2025-09-19 · Updated 2025-09-19 · CVE-2025-10690

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Goza - Nonprofit Charity WordPress Theme versions prior to and including 3.2.2

Description The Goza - Nonprofit Charity WordPress Theme is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the beplus import pack install plugin function. This allows unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations, potentially leading to remote code execution.

Recommendations Update Goza - Nonprofit Charity WordPress Theme to a version later than 3.2.2.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10690

Affected Products

Goza - Nonprofit Charity Wordpress Theme

References · 8

• https://cve.org/CVERecord?id=CVE-2025-5394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10690 · Security Note
• https://twitter.com/offseq/status/1968872948401324280 · Twitter Post
• https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575 · Note
• https://twitter.com/CveFindCom/status/1968875138046140865 · Twitter Post
• https://t.me/CVEtracker/32897 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve · Note
• https://twitter.com/CVEnew/status/1968923561755627760 · Twitter Post