Arbitrary File Deletion Flaw in Home Villas Real Estate Theme for WordPress

CVE-2025-5014

What is CVE-2025-5014?

The Home Villas Real Estate WordPress Theme contains a flaw that allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. This vulnerability arises from insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function, present in all versions up to and including 2.8. If exploited, this can lead to serious security risks, including the potential for remote code execution, especially if critical files such as wp-config.php are targeted.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References