CVE-2025-10690

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10690", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-18T13:57:31.775Z", "datePublished": "2025-09-19T02:27:00.685Z", "dateUpdated": "2026-04-08T16:57:05.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:05.652Z"}, "affected": [{"vendor": "Bearsthemes", "product": "Goza - Nonprofit Charity WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution."}], "title": "Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve"}, {"url": "https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-5394"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "grov x"}], "timeline": [{"time": "2025-09-08T19:58:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-19T13:09:25.232160Z", "id": "CVE-2025-10690", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T13:09:32.889Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-19T13:09:25.232160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T13:09:29.292Z"}}], "cna": {"title": "Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation", "credits": [{"lang": "en", "type": "finder", "value": "grov x"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Bearsthemes", "product": "Goza - Nonprofit Charity WordPress Theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-08T19:58:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve"}, {"url": "https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-5394"}], "descriptions": [{"lang": "en", "value": "The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:05.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10690", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:57:05.652Z", "dateReserved": "2025-09-18T13:57:31.775Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-19T02:27:00.685Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Goza - Nonprofit Charity WordPress Theme", "vendor": "Bearsthemes", "versions": [{"lessThanOrEqual": "3.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution."}], "id": "CVE-2025-10690", "lastModified": "2026-06-17T08:28:46.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10690", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-19T13:09:25.232160Z", "version": "2.0.3"}}]}, "published": "2025-09-19T03:15:35.177", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575"}, {"source": "security@wordfence.com", "url": "https://www.cve.org/CVERecord?id=CVE-2025-5394"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:53:20.464198+00:00", "value": {"mitigation_remediation": ["Update the Goza theme to the latest supported version that includes the missing capability check.", "If an update is not immediately possible, whitelist the approval of file uploads by adding a capability check in the 'beplus_import_pack_install_plugin' function or disable the import plugin functionality until a patch is applied.", "Deploy a security plugin or configure the web server to reject execution of uploaded files and enforce strict MIME type checks, ensuring that zip uploads cannot execute as PHP code."], "summary": {"action": "Immediate patch", "impact": "Remote code execution"}, "threat_synthesis": {"affected_systems": "Any installation of Bearsthemes Goza - Nonprofit Charity WordPress Theme version 3.2.2 or earlier is affected. The vulnerability is present in all releases up to and including 3.2.2 of this theme, which is distributed through ThemeForest and used by WordPress sites that import plugin packs.", "description_and_impact": "The Goza - Nonprofit Charity WordPress Theme includes a function that processes plugin installation requests but fails to validate user privileges. This missing capability check allows an attacker who is not logged in to upload an arbitrary zip file. If the zip contains a webshell or other executable code, the attacker can gain remote code execution on the underlying WordPress server. The primary weakness corresponds to CWE-862, an authorization failure that permits unauthorized access to privileged operations.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires only unauthenticated access to the WordPress site with the vulnerable theme enabled, and the sole prerequisite is the ability to visit the import plugin endpoint, which is typically publicly reachable. Successful exploitation results in full remote code execution on the WordPress host."}}}}, "created": "2025-09-19T09:35:15.281253+00:00", "updated": "2026-04-22T17:00:12.325983+00:00", "vendors": ["bearsthemes", "bearsthemes$PRODUCT$goza_nonprofit_charity_wordpress_theme", "wordpress", "wordpress$PRODUCT$wordpress"]}