Arbitrary File Deletion Vulnerability in Game Users Share Buttons Plugin for WordPress

CVE-2025-6755

What is CVE-2025-6755?

The Game Users Share Buttons plugin for WordPress contains a vulnerability that allows attackers with Subscriber-level privileges to perform arbitrary file deletions. This security flaw arises due to inadequate validation of file paths within the ajaxDeleteTheme() function. By manipulating the themeNameId parameter in an AJAX request, attackers can potentially specify harmful file paths, including critical system files like wp-config.php, which may lead to remote code execution. Users of versions 1.3.0 and earlier are at risk and should take immediate action to secure their installations.

References