Arbitrary File Deletion Vulnerability in Goza Nonprofit Charity Theme for WordPress

CVE-2025-10134

What is CVE-2025-10134?

The Goza - Nonprofit Charity WordPress Theme contains a security flaw that allows unauthenticated attackers to delete arbitrary files on the server. This vulnerability arises from inadequate file path validation within the alone_import_pack_restore_data() function, affecting all versions prior to and including 3.2.2. Exploiting this weakness can lead to severe consequences, such as remote code execution, especially if critical files like wp-config.php are deleted. It is essential for users of the theme to take immediate corrective measures to mitigate potential attacks.

References