Arbitrary File Deletion Vulnerability in Vikinger Theme by WordPress

CVE-2025-4946

What is CVE-2025-4946?

The Vikinger theme for WordPress contains a security flaw allowing authenticated users with Subscriber access or higher to perform arbitrary file deletions. This vulnerability arises from insufficient validation in the vikinger_delete_activity_media_ajax() function, applicable to all versions up to and including 1.9.32. If exploited, it may enable attackers to delete critical files on the server, such as wp-config.php, increasing the risk of remote code execution. To mitigate this vulnerability, ensure the Vikinger Media plugin is properly managed and updated.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References