CVE-2025-7778

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7778", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-17T22:02:28.623Z", "datePublished": "2025-08-15T08:25:39.109Z", "dateUpdated": "2026-04-08T16:42:19.505Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:19.505Z"}, "affected": [{"vendor": "artkrylov", "product": "Icons Factory", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."}], "title": "Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24f31bbf-883f-4903-847a-7bfc3e45654c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/icons-factory/tags/1.6.12/icons-factory.php#L1330"}, {"url": "https://wordpress.org/plugins/icons-factory/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-08-14T20:15:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-15T16:14:36.348913Z", "id": "CVE-2025-7778", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T16:14:50.555Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7778", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-15T16:14:36.348913Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T16:14:41.852Z"}}], "cna": {"title": "Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "artkrylov", "product": "Icons Factory", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-14T20:15:38.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24f31bbf-883f-4903-847a-7bfc3e45654c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/icons-factory/tags/1.6.12/icons-factory.php#L1330"}, {"url": "https://wordpress.org/plugins/icons-factory/#developers"}], "descriptions": [{"lang": "en", "value": "The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:19.505Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7778", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:19.505Z", "dateReserved": "2025-07-17T22:02:28.623Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-15T08:25:39.109Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Icons Factory", "vendor": "artkrylov", "versions": [{"lessThanOrEqual": "1.6.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."}, {"lang": "es", "value": "El complemento Icons Factory para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos debido a una autorizaci\u00f3n insuficiente y una validaci\u00f3n de ruta incorrecta dentro de la funci\u00f3n delete_files() en todas las versiones hasta la 1.6.12 incluida. Esto permite que atacantes no autenticados eliminen archivos arbitrarios en el servidor, lo que puede provocar f\u00e1cilmente la ejecuci\u00f3n remota de c\u00f3digo al eliminar el archivo correcto (como wp-config.php)."}], "id": "CVE-2025-7778", "lastModified": "2026-06-17T10:05:38.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7778", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-15T16:14:36.348913Z", "version": "2.0.3"}}]}, "published": "2025-08-15T09:15:30.367", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/icons-factory/tags/1.6.12/icons-factory.php#L1330"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/icons-factory/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24f31bbf-883f-4903-847a-7bfc3e45654c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:28:27.835266+00:00", "value": {"mitigation_remediation": ["Upgrade the Icons Factory plugin to the latest version that includes an authorization check for delete_files().", "If an upgrade cannot be performed immediately, deactivate or remove the plugin to eliminate the exploitation pathway.", "Restrict file system permissions for the plugin\u2019s directories so that the web process cannot delete files, thereby adding a defense\u2011in\u2011depth layer for the affected component."], "summary": {"action": "Immediate Patch", "impact": "Remote File Deletion leading to Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the Icons Factory plugin by the vendor artkrylov running any version up to and including 1.6.12 are affected. The vulnerability applies to any WordPress site that has this plugin enabled, regardless of user role or site configuration.", "description_and_impact": "The Icons Factory plugin for WordPress contains a flaw where its delete_files() function lacks proper authorization checks and path validation. This permits an unauthenticated user to delete any file on the server by supplying a target path. Removing critical files such as wp-config.php can compromise configuration and enable a malicious actor to take control of the site, resulting in loss of confidentiality, integrity, and availability. The weakness is a classic example of CWE\u2011285, Unauthorized Access for a Trusted System Component.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA KEV. Nevertheless, the flaw can be leveraged remotely via HTTP requests to the plugin\u2019s delete endpoint, allowing unauthenticated attackers to delete arbitrary files and potentially execute code. The attack vector is inferred to be remote over the web, exploiting the lack of authentication checks in the plugin\u2019s file deletion routine."}}}}, "created": "2025-08-16T21:40:49.247035+00:00", "updated": "2026-04-22T14:30:18.962786+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}