File Upload Vulnerability in Goza Nonprofit Charity WordPress Theme by ThemeForest

CVE-2025-10690

What is CVE-2025-10690?

The Goza Nonprofit Charity WordPress Theme is susceptible to unauthorized arbitrary file uploads due to the absence of proper capability checks in the 'beplus_import_pack_install_plugin' function. This vulnerability allows unauthenticated attackers to upload malicious zip files masquerading as plugins, which could lead to remote code execution on the server. The issue exists in all versions up to and including 3.2.2, highlighting a significant security risk for users of this theme.

References