Arbitrary File Deletion Flaw in Home Villas Real Estate Theme for WordPress

CVE-2025-5014

What is CVE-2025-5014?

The Home Villas Real Estate WordPress Theme contains a flaw that allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. This vulnerability arises from insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function, present in all versions up to and including 2.8. If exploited, this can lead to serious security risks, including the potential for remote code execution, especially if critical files such as wp-config.php are targeted.

References