CVE-2025-10134

CVE-2025-10134 affects Goza – Nonprofit Charity WordPress Theme up to version 3.2.2. The flaw is in the alone_import_pack_restore_data() function, where insufficient file path validation allows an unauthenticated attacker to delete arbitrary server files (e.g., wp-config.php), with potential remo...

WordPress Goza Theme 3.2.2 is vulnerable to Arbitrary File Deletion

Software Goza Type Theme Vulnerable versions 3.2.2 Fixed in 3.2.3 OWASP Top 10 A1: Injection Classification Arbitrary File Deletion CVE CVE-2025-10134 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 14b5ad5ea9b5 Credits Thái An Required privilege Unauthenticated Publishe...