CVE-2025-10690: Goza WordPress Theme RCE Vulnerability

CVE-2025-10690 Overview

The Goza - Nonprofit Charity WordPress Theme for WordPress contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files and achieve remote code execution. The vulnerability exists due to a missing capability check on the beplus_import_pack_install_plugin function in all versions up to and including 3.2.2, enabling attackers to upload zip files containing webshells disguised as plugins from remote locations.

Critical Impact
Unauthenticated attackers can upload webshells and achieve remote code execution on affected WordPress sites, potentially leading to complete site compromise, data theft, and server takeover.

Affected Products

Goza - Nonprofit Charity WordPress Theme versions up to and including 3.2.2
WordPress installations using vulnerable Goza theme versions

Discovery Timeline

September 19, 2025 - CVE-2025-10690 published to NVD
September 19, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10690

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), representing a critical broken access control flaw. The beplus_import_pack_install_plugin function within the Goza WordPress theme lacks proper capability checks, allowing any user—including unauthenticated visitors—to invoke this functionality. The function is designed to install plugins from external sources as part of the theme's demo import feature, but without authorization controls, attackers can abuse this mechanism to upload arbitrary zip files.

The attack requires no authentication and can be executed remotely over the network with minimal complexity. Successful exploitation grants attackers the ability to upload webshells disguised as legitimate WordPress plugins, which are then extracted and executed on the server. This provides full confidentiality, integrity, and availability impact on the target system.

Root Cause

The root cause of this vulnerability is the complete absence of capability checks (such as current_user_can()) in the beplus_import_pack_install_plugin function. WordPress themes and plugins that handle file uploads or plugin installations must verify that the requesting user has appropriate administrative privileges. The Goza theme fails to implement this security control, allowing the function to execute regardless of the user's authentication state or role.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker can send a crafted HTTP request to the vulnerable endpoint, specifying a remote URL containing a malicious zip file. The theme's import functionality fetches this file and installs it as if it were a legitimate plugin. The malicious zip typically contains a PHP webshell that, once extracted, provides the attacker with a persistent backdoor to execute arbitrary commands on the web server.

The exploitation process typically involves:

Identifying a WordPress site using the vulnerable Goza theme
Crafting an HTTP request to the beplus_import_pack_install_plugin endpoint
Pointing the request to a remote server hosting a malicious zip file containing a webshell
The theme automatically downloads and extracts the payload as a plugin
Attacker accesses the installed webshell to execute arbitrary commands

Detection Methods for CVE-2025-10690

Indicators of Compromise

Unexpected plugin installations in the wp-content/plugins/ directory
Suspicious PHP files with obfuscated code or webshell signatures
HTTP requests to theme import endpoints from external IP addresses
Unexpected outbound connections from the web server to unknown hosts
New files with recent modification dates in plugin directories that weren't installed by administrators

Detection Strategies

Monitor web server access logs for POST requests to theme import endpoints containing external URLs
Implement file integrity monitoring on the wp-content/plugins/ directory to detect unauthorized additions
Deploy web application firewalls (WAF) with rules to block unauthorized file upload attempts
Use WordPress security plugins to audit plugin installations and detect anomalies

Monitoring Recommendations

Enable real-time file system monitoring on WordPress installation directories
Configure alerting for new plugin installations that bypass the WordPress admin interface
Monitor outbound network connections from the web server for suspicious destinations
Review WordPress audit logs regularly for unauthorized administrative actions

How to Mitigate CVE-2025-10690

Immediate Actions Required

Update the Goza - Nonprofit Charity WordPress Theme to a patched version if available
If no patch is available, consider deactivating and removing the vulnerable theme
Audit the wp-content/plugins/ directory for any unauthorized or suspicious files
Review web server access logs for signs of exploitation attempts
Implement additional access controls at the web server level to restrict access to theme import endpoints

Patch Information

Organizations should monitor the ThemeForest page for Goza theme for security updates. Additionally, the Wordfence Vulnerability Analysis provides detailed information about this vulnerability and remediation guidance.

Workarounds

Block external requests to the theme's import functionality using .htaccess rules or web server configuration
Implement authentication requirements at the web server level for all plugin import endpoints
Use a Web Application Firewall (WAF) to filter requests containing suspicious file upload patterns
Restrict the WordPress site's ability to make outbound HTTP requests if demo import functionality is not needed

bash

# Example .htaccess rule to block access to vulnerable endpoint
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} beplus_import_pack_install_plugin [NC]
    RewriteRule .* - [F,L]
</IfModule>