Arbitrary File Deletion in Icons Factory Plugin for WordPress

CVE-2025-7778

What is CVE-2025-7778?

The Icons Factory plugin for WordPress suffers from an Arbitrary File Deletion vulnerability, primarily due to insufficient authorization checks and improper path validation in the delete_files() function. This flaw exists in all versions up to and including 1.6.12, enabling unauthenticated attackers to delete arbitrary files on the server. If exploited, this vulnerability can lead to severe consequences, such as remote code execution, especially if critical files like wp-config.php are targeted.

References