Arbitrary File Deletion Vulnerability in Vikinger Theme by WordPress

CVE-2025-4946

What is CVE-2025-4946?

The Vikinger theme for WordPress contains a security flaw allowing authenticated users with Subscriber access or higher to perform arbitrary file deletions. This vulnerability arises from insufficient validation in the vikinger_delete_activity_media_ajax() function, applicable to all versions up to and including 1.9.32. If exploited, it may enable attackers to delete critical files on the server, such as wp-config.php, increasing the risk of remote code execution. To mitigate this vulnerability, ensure the Vikinger Media plugin is properly managed and updated.

References