Paper/Archive/CVE-2025-7778

CVE-2025-7778

artkrylov Icons Factory — Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.3.533 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected

ProductAffectedFixed inSource

Icons Factory≤ 1.6.12–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/24f31bbf-883f-4903-847a-7bfc3e45654c?source=cve refplugins.trac.wordpress.org/browser/icons-factory/tags/1.6.12/icons-factory.php#L1330 refwordpress.org/plugins/icons-factory/#developers