CVE-2025-7778
BaseFortify
Publication date: 2025-08-15
Last updated on: 2025-08-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| artemy | icons_factory | 1.6.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Icons Factory plugin for WordPress allows unauthenticated attackers to delete arbitrary files on the server due to insufficient authorization and improper path validation in the delete_files() function. This means attackers can remove critical files, potentially leading to further exploitation such as remote code execution.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including deletion of important server files like wp-config.php, which can lead to remote code execution. This compromises the security, integrity, and availability of the affected WordPress site and server.